PSS: Password Self Service: No "Admin Defined Questions" available for security question registration

Dear Experts,
I have configured PSS as below,
Activated "PSS" in connector configuration.
Configure PSS as per SAP note.
Configured 2 Questions and activated them.
Maintained "Service User" in 10 services mentioned in SAP note
After this when I try to register new user with "Admin Defined Questions" I do not get any question to select, it comes as a blank field. But I can register with user defined questions and can reset password as well as get mail for the same too.
Questions:
How to deactivate "User Defined Questions" option?
Why I am not getting "Admin Defined Questions" for security question registration?
Did anybody faced the same issue?
Thanks in advance,
BR,
Mangesh

Hi Friends,
Any advice on the same.
I have three issues for PSS,
Admin question are not visible
set option "Challenge response"
Set admin questions and marked them active
No system displayed during password reset
Marked connector as PSS activated
User available in backend as this is allow me to login for users available in backend system through end user logon page
GRACUSER and GRACUSRCONN has the entry
How to deactivate option "user defined question" for all users
Any suggestions. I have tried options suggested on community through threads but no luck till.
Raised it to SAP now but if anyone can suggest would be great so I would try it.
BR,
Mangesh

Similar Messages

CUP 5.3. Password Self Service description+sequence

Hi together,
where is it possible to chance the password self service description? The description appears on the "request access"-screen. Every requesttype can be changed in the configuration but not the password self service. Also it isn't possible to change the sequence...
Is this correct? Or is there a other possibility I didn't notice?
Thanks & Best Regards
Alexa

Hi,
we are on SP8 but we will upgrade to SP09 in the next weeks...
I need to change the desciption because of different language requirements for different users. Because the requestors aren't in the UME we can't make varieties in the language with the login. We enter the requesttypes in two languages in the description field. So that all requestors understand the different types. But this isn't possible for the password-self-service, because there is no configuration for the description.
Perhaps my question will be solved with SP09
Thanks.
Alexa

Bypass security question in Password self service in AC 10

We have configured Password self service in AC10. But as we have integrated with SSO so we do not want a security question registration and its answer to be filled during reset .
So my query, is it possible to bypass the security question and reset the password successfully.

we could have password self service running without security question.
regards
Hemant

Password Self Service

Friends,
We are trying to implement password self service for SAP, AD and Non-SAP systems. The installation and post configuration is complete.
The dispatchers are defined and running sucessfully and the task for Password Reset is defined. The problem is the password reset task/job is not running or picked up by the dispatcher, its always in idle mode. The job logs are also empty.
Are we missing something....we are new to IDM and running 7.1
Regards,
Muthu Kumaran KG

Matt,
Here is the requirement.,
- Password self service for multiple SAP systems and AD
- Password Synchronisation between AD's
Right now I'm trying to configure the PSS. Followed the SAP document and created tasks for password reset, edit authentication questions and password reset failed.
The users will register their authentication questions (http://<server>:port/idm) and after that they do self service (http://<sercer>:port/idm/pwdreset) by answering those questions.
Thanks.
Regards,
Muthu Kumaran KG

GRC CUP 5.3 SP16.3 -Password self service limit

Hello Experts,
We came across the issue when integrating Password Self Service(PSS) via challenge response to ask users to answer 2 security questions that they self register the answers to. We noticed that users can even put only one character value in the answers to the security questions, and it accepts it and sends the user the re-set password info to re-log in to the sap backend system via email.
But this is not good bc the security answers should be at least a certain character length with a mixture of upper case ,lower case or numbers..but at least give us the capability to not allow one character answers for the challenge response questions. Is there any1 else who has also faced these issues and know if SAP provided any SAP notes or something to fix the issue. Otherwise, this is not secure enough to reset passwords via one character answers to the challenge response questions.
Thanks and Regards,
A

So, SAP stated that functionality is not available as of right now and to send an enhancement request. I'm surprised they didn't think of this when configuring PSS to ensure the challenge response questions would be well protected and would require at least min character length, etc..

Password self service in AC10

What is the procedure to roll out Password self service in a 1000+ company. Does it means all the backend system users has to be copied to GRC Production system to use this feature.
If the user wants to reset his password, is it necessarily to login with GRC Password first into GRC and than reset the backend password. If this is the case, than there are less chances that users will remember his GRC password to login into it to reset the password.

A user shouldn't need access to the GRC box itself to use PSS.
Look at the PSS configuration under SPRO->GRC->AC->User Provisioning->Maintain PSS
You can set the authentication source for a user attempting to leverage the PSS feature. You can use the Challenge Questions themselves or another HR system. Also, under that same IMG tree, you will also need to ensure your End User Logon URL is activated and setup properly. This would be the URL individuals would use to access the basic AC features (creating requests, PSS, etc) whom do not have AC accounts themselves.
The key design decisions will be where you will be storing a user's challenge questions and how you will ensure they have their answers registered (ideally part of their onboarding) so that they can use the PSS tool.

CUP Password Self Service

Hi,
I have some problems with using the password self service.
The user has answered the challenge response and is registered. After losing the password the user tries to access the password self service link. Therefore he has to login - why??? This doesn't makes at all, as the user lost his password! Did I miss a setting or did I misunderstood the functionality???
Best regards,
Christian

Hi Christian,
sure this authentication depends on the "Authentication" configuration, but I wouldn't change this data source as you probably had a reason for choosing a SAP system as data source.
Following things I figured:
- setting the Self-Service to "SAP HR" and configuring the "Disable Verification" to "Password Self-Service" will do exactly what you need: no authentication needed but verification by HR info types. This extra logon before the verification can be disabled like it was in 5.2
Unfortunately you will need an HR system with data configured for all users using PSS
- setting Self-Service to "Challenge Response", by setting the "Disable Verification" to "None" you can disable the questions but NOT the initial logon
I can't really figure why this is working the opposite way for both types of password self-service. Let me know if you find a nice solution. Or did you open an OSS?
Regards,
Daniela

Error when try access password self service

Hi,
We are on AC5.3, patch level 11. We are trying to setup password self service but we are not very successfull.
When trying to access password self service screen i type in a username and select logon. I then get the following error message:
Application error occurred during request processing.
Details:   java.lang.NullPointerException: null
Exception id: [00215E963384006600005C47000005DC000487177DFC3B51]
The java log is as follows:
2010-05-21 11:05:56,616 [SAPEngine_Application_Thread[impl:3]_4] ERROR Ignorning exception in search by uniqueldapkey, searching by dn
com.sun.jndi.ldap.LdapReferralException: Continuation Reference; remaining name ''
     at com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreReferrals(LdapNamingEnumeration.java:345)
     at com.sun.jndi.ldap.LdapNamingEnumeration.hasMoreImpl(LdapNamingEnumeration.java:224)
     at com.sun.jndi.ldap.LdapNamingEnumeration.hasMore(LdapNamingEnumeration.java:187)
     at com.virsa.ae.service.umi.ldap.LDAPSearchUser.getUserByDN(LDAPSearchUser.java:274)
     at com.virsa.ae.service.umi.ldap.LDAPSearchUser.setManagerDetails(LDAPSearchUser.java:908)
     at com.virsa.ae.service.umi.ldap.LDAPSearchUser.getUsers(LDAPSearchUser.java:695)
     at com.virsa.ae.service.umi.ldap.LDAPSearchUser.getUserById(LDAPSearchUser.java:880)
     at com.virsa.ae.service.umi.ldap.LDAPUserDetailsProvider.getUser(LDAPUserDetailsProvider.java:52)
     at com.virsa.ae.actions.LoginAction.verifyRequestorLoginHandler(LoginAction.java:607)
     at com.virsa.ae.actions.LoginAction.execute(LoginAction.java:102)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Please advise.
Regards

2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@85:execute() : Current Module: |STARTUP_MODULE| Conversation: |STARTUP_CONVERSATION| Screen: |scrRequestAccess|
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@105:execute() : Module#STARTUP_MODULE#Conversation#STARTUP_CONVERSATION#Screen#scrRequestAccess#Action#verifyRequestorLogin#
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@285:execute() : Handler found:class com.virsa.ae.actions.LoginAction
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LoginAction.java@437:verifyRequestorLoginHandler() : INTO the method
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPAuthenticator.java@66:<init>() : INTO the method : ZACTAD3
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPHandlerFactory.java@30:getHandler() : INTO the method : ldapServerType :ADldapSystemName :ZACTAD3
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG UMIFactory.java@116:getAuthenticator() : OUT of the method : Authenticator com.virsa.ae.service.umi.ldap.LDAPAuthenticator@17581758 found for authenticationType:LDAP authenticationSystem:ZACTAD3 authenticationStrategy:
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPAuthenticator.java@66:<init>() : INTO the method : ZACTAD3
2010-05-21 14:54:06,787 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPHandlerFactory.java@30:getHandler() : INTO the method : ldapServerType :ADldapSystemName :ZACTAD3
2010-05-21 14:54:06,787 [SAPEngine_Application_Thread[impl:3]_33] DEBUG UMIFactory.java@116:getAuthenticator() : OUT of the method : Authenticator com.virsa.ae.service.umi.ldap.LDAPAuthenticator@5a8f5a8f found for authenticationType:LDAP authenticationSystem:ZACTAD3 authenticationStrategy:
2010-05-21 14:54:06,788 [SAPEngine_Application_Thread[impl:3]_33] DEBUG Processing interrupted Caused by conversation Interrupted
com.virsa.ae.commons.utils.framework.servlet.InterruptProcessingException: conversation Interrupted
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:299)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
com.virsa.ae.commons.utils.framework.InterruptConversationException: Forcing user to login
     at com.virsa.ae.actions.LoginAction.verifyRequestorLoginHandler(LoginAction.java:677)
     at com.virsa.ae.actions.LoginAction.execute(LoginAction.java:90)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
     ... 24 more
2010-05-21 14:54:06,816 [SAPEngine_Application_Thread[impl:3]_35] DEBUG AEFrameworkServlet.java@521:logRequest() :
-- Request dump for Action Path is loadRequestorLoginPage
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG AEFrameworkServlet.java@546:logRequest() : -- End Request dump for Action Path is loadRequestorLoginPage
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG NavigationEngine.java@85:execute() : Current Module: |STARTUP_MODULE| Conversation: |STARTUP_CONVERSATION| Screen: |scrRequestAccess|
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG NavigationEngine.java@105:execute() : Module#STARTUP_MODULE#Conversation#STARTUP_CONVERSATION#Screen#scrRequestAccess#Action#loadRequestorLoginPage#
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG NavigationEngine.java@285:execute() : Handler found:class com.virsa.ae.actions.SuccessAction
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG NavigationEngine.java@296:execute() : Target returned by execute action: success
2010-05-21 14:54:06,817 [SAPEngine_Application_Thread[impl:3]_35] DEBUG AEFrameworkServlet.java@458:service() : forwarding to:/eu_login.jsp
2010-05-21 14:54:06,818 [SAPEngine_Application_Thread[impl:3]_35] DEBUG AECacheUtil.java@2139:getDropDownList() : INTO the method : hmFA{DE=German, KO=Korean, SK=Slovak, NL=Dutch, IT=Italian, CS=Czech, PT=Portuguese, HR=Croatian, FR=French, PL=Polish, NO=Norwegian, FI=Finnish, ZH=Chinese, HU=Hungarian, JA=Japanese, ES=Spanish, EN=English, DA=Danish, RU=Russian, SV=Swedish}
2010-05-21 14:54:11,067 [SAPEngine_Application_Thread[impl:3]_16] DEBUG AEFrameworkServlet.java@521:logRequest() :
-- Request dump for Action Path is requestorLogin1
2010-05-21 14:54:11,067 [SAPEngine_Application_Thread[impl:3]_16] DEBUG AEFrameworkServlet.java@541:logRequest() : requestType:0::PSS#
2010-05-21 14:54:11,067 [SAPEngine_Application_Thread[impl:3]_16] DEBUG AEFrameworkServlet.java@541:logRequest() : selLanguage:0::#
2010-05-21 14:54:11,067 [SAPEngine_Application_Thread[impl:3]_16] DEBUG AEFrameworkServlet.java@541:logRequest() : j_user:0::PADAM#
2010-05-21 14:54:11,067 [SAPEngine_Application_Thread[impl:3]_16] DEBUG AEFrameworkServlet.java@546:logRequest() : -- End Request dump for Action Path is requestorLogin12010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@85:execute() : Current Module: |STARTUP_MODULE| Conversation: |STARTUP_CONVERSATION| Screen: |scrRequestAccess|
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@105:execute() : Module#STARTUP_MODULE#Conversation#STARTUP_CONVERSATION#Screen#scrRequestAccess#Action#verifyRequestorLogin#
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG NavigationEngine.java@285:execute() : Handler found:class com.virsa.ae.actions.LoginAction
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LoginAction.java@437:verifyRequestorLoginHandler() : INTO the method
2010-05-21 14:54:06,772 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPAuthenticator.java@66:<init>() : INTO the method : ZACTAD3
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPHandlerFactory.java@30:getHandler() : INTO the method : ldapServerType :ADldapSystemName :ZACTAD3
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG UMIFactory.java@116:getAuthenticator() : OUT of the method : Authenticator com.virsa.ae.service.umi.ldap.LDAPAuthenticator@17581758 found for authenticationType:LDAP authenticationSystem:ZACTAD3 authenticationStrategy:
2010-05-21 14:54:06,784 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPAuthenticator.java@66:<init>() : INTO the method : ZACTAD3
2010-05-21 14:54:06,787 [SAPEngine_Application_Thread[impl:3]_33] DEBUG LDAPHandlerFactory.java@30:getHandler() : INTO the method : ldapServerType :ADldapSystemName :ZACTAD3
2010-05-21 14:54:06,787 [SAPEngine_Application_Thread[impl:3]_33] DEBUG UMIFactory.java@116:getAuthenticator() : OUT of the method : Authenticator com.virsa.ae.service.umi.ldap.LDAPAuthenticator@5a8f5a8f found for authenticationType:LDAP authenticationSystem:ZACTAD3 authenticationStrategy:
2010-05-21 14:54:06,788 [SAPEngine_Application_Thread[impl:3]_33] DEBUG Processing interrupted Caused by conversation Interrupted
com.virsa.ae.commons.utils.framework.servlet.InterruptProcessingException: conversation Interrupted
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:299)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:431)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.doWork(RequestDispatcherImpl.java:321)
     at com.sap.engine.services.servlets_jsp.server.runtime.RequestDispatcherImpl.forward(RequestDispatcherImpl.java:377)
     at com.virsa.ae.commons.utils.framework.servlet.AEFrameworkServlet.service(AEFrameworkServlet.java:461)
     at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.runServlet(HttpHandlerImpl.java:401)
     at com.sap.engine.services.servlets_jsp.server.HttpHandlerImpl.handleRequest(HttpHandlerImpl.java:266)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:386)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.startServlet(RequestAnalizer.java:364)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.invokeWebContainer(RequestAnalizer.java:1039)
     at com.sap.engine.services.httpserver.server.RequestAnalizer.handle(RequestAnalizer.java:265)
     at com.sap.engine.services.httpserver.server.Client.handle(Client.java:95)
     at com.sap.engine.services.httpserver.server.Processor.request(Processor.java:175)
     at com.sap.engine.core.service630.context.cluster.session.ApplicationSessionMessageListener.process(ApplicationSessionMessageListener.java:33)
     at com.sap.engine.core.cluster.impl6.session.MessageRunner.run(MessageRunner.java:41)
     at com.sap.engine.core.thread.impl3.ActionObject.run(ActionObject.java:37)
     at java.security.AccessController.doPrivileged(AccessController.java:219)
     at com.sap.engine.core.thread.impl3.SingleThread.execute(SingleThread.java:104)
     at com.sap.engine.core.thread.impl3.SingleThread.run(SingleThread.java:176)
Caused by:
com.virsa.ae.commons.utils.framework.InterruptConversationException: Forcing user to login
     at com.virsa.ae.actions.LoginAction.verifyRequestorLoginHandler(LoginAction.java:677)
     at com.virsa.ae.actions.LoginAction.execute(LoginAction.java:90)
     at com.virsa.ae.commons.utils.framework.NavigationEngine.execute(NavigationEngine.java:295)
     ... 24 more
2010-05-21 14:54:06,816 [SAPEngine_Application_Thread[impl:3]_35] DEBUG AEFrameworkServlet.java@521:logRequest() :

SAP GRC Compliant User Provisioning (CUP) Password Self Service

Hello everyone,
I am setting up Password Self Service within CUP. For those users that do not already have access to the UME frontend, I know that I need to create a user ID in the UME frontend for each user so that they can access the Password Self Service option. Since I only want the user to access the Password Self Service option, what UME role do I assign to them to ensure that they cannot access anything else within CUP?
Thank you!
Johonna

Johonna,
The 3 defined roles are only those suggested by SAP.
You can create your own roles by assigning the various actions as needed to provide access or restrict as your organisation requires.
However, depending on your patch level, you may find that certain actions are dependant on others to work properly.
Also, you either grant access to the functionality or not. There is no partial or display only setting in the java stack.
Enjoy!
Simon

CUP 5.3 Password-Self-Service SP9

Hello all,
since CUP 5.3 SP09, the Password-Self-Service has complety changed.
You need to Login to the System before you can reset the password. The Authentication System is linked to the UME, which is connected to an SAP-System where all approvers have a User.
The PSS is used by all our SAP-Users, not only approvers. So, not all Users have a UserID in the UME.
-> From SP 09, the PSS is not working anymore for most of our users, since a Login to use the PSS is needed.
Due to different errors, we had to patch the system now to SP14.
We have activated SSO as recommended in note 1451616 does not help as not all Users have access to our UME.
Does anyone has similar problems / experiences? And an idea for a workaround?
Thanks a lot
Marco

Hello Kristian,
unfortunatly thats not possible, because the UserIDs in the SAP-Systems are different (we are using personnel-number).
So, regular CUP-requests could not be approved any longer as the approvers have to login with their personnel-ID to approve the requests pending. The LineManager-approver ID is getting read from HR.
It is not possible to choose different UserDataSource to Login for PSS and approvals. And in the new PSS-Version, you can only reset the password for the ID you are logged in.
thanks
Marco

CUP v5.3 - Password Self Service - HR Fields Out or Order

Hello everyone,
I have set up Password Self Service in CUP v5.3 for SAP HR. In the Configuration --> Self Service, I have created a few Infotype/Subtype entries. When I go to reset a test user ID's password, the Infotype/Subtype fields appear in a different order than the order in which they are configured in CUP.
What's worse is that even one of the Infotypes is separated from itself by another Infotype/Subtype. For instance, we are testing using IT0009 Bank Details with two Fields: Bank Key and Bank Account Number. Even though I cofigured these two fields to be one after another, the logon screen has them separated by one of the other Infotype/Subtype options.
There doesn't seem to be any logic in the way that the system has adjust the sequence. It's not in alphabetical order, not in numberical order by Infotype, and more importantly, not in the order that I configured them. This will make it very confusing for the users, which of course, defeats the purpose.
Any insight into this?
Thank you!
Johonna

Hello Simon,
That's what I thought was happening at first, but it doesn't appear so. It's not going my the text, technical name , or number for the Infotype, Subtype, or Field Name. What's even stranger ... I deleted them all, then recreated them in the same order that I did the first time, and not only did it not come up in the right sequence, the sequence was different than the first time! Both created the same, both resulted in an incorrect sequence, and yet both came out different!
Even though they are standard HR fields, I might try creating custom versions so that I can force the sequence with the Z01, Z02 naming convention like you did.
Thank you!
Johonna

CUP-Password Self Service-Email not received by user

Hi,
I confidured SMTP server with Mail server information.
I raised a request for Password Self-service for a User.
Request executed successfuly with a message " Password was reset and send to email id of user"
Password in backend system has reset successfully,
but No Email has received by user regarding reset PW.
What si the problem, why the user not received email? even in CUP it shows that email sent successfully.

Hi,
Yes i scheduled email dispatcher.
Now Email is received by the user.
User received a link for password, when user click on that a blank page with header Password is displayed.
no other information is appearing.
Thanks
Ram.

Password Self-Service in SUN IDM

Does anyone know if a Password Self-Service is a component of SUN IDM or stand along application? Does SUN offer a seperate Password reset feature?
Thanks!

Sun Identity Manager has built in password recovery functions and you can also use anonymous workflows to produce completely customized processes.

Password self-service workflow message

Hello
Where in configuration do I go to change the password self-service workflow message:
"Your password has been reset. Your password is..."
I know where these messages are for provisioning, but not sure where to go for p/w s-s.
Thanks
JD

Hi,
As Chinmaya mentioned, this message is not easily available to configure. None of the emails are being maintained in backend systems. All of these messages are maintained in NW (front-end) table called Virsa_AE_Message. Go to this table and search for the correspnding message and change it.
FYI, when you upgrade to new SP and upload the initial data xml file, it will overwrite the changes you have made to the message.
Regards,
Alpesh

Password Self Service - User receive new Password Email - But link empty

With Password Self Service we sometimes have users that get the Email with the link.
But when they open the link it is just an empty page.
(as if it has been opened before or the password show time has passed)
Have anyone had this issue?
Thank you

Hi Kristian,
guess you talk about AC 5.3.
Please check in CUP -> Configuration -> Workflow -> SMTP if you have configured some application url.
If not, are you using SSL or SSO, there might be an issue then.
Best,
Frank

PSS: Password Self Service: No "Admin Defined Questions" available for security question registration

Similar Messages

Maybe you are looking for