Firefighter ID getting locked due to incorrect logons

[Former Member]

Hi Experts,

we've implemented Firefighter, and converted the FF ID into a service ID as advised by SAP. This would ensure that the FF ID's passwords would never expire. However we had an incident where someone attempted to login directly to the FF ID. 3 incorrect password attempts, the FF ID got locked. Subsequently when someone authorised attempted to logon via the VFAT dashboard, the FFID was locked. We had to use another super ID to unlock the first. How can we prevent this from happening again? We understand that the access to the FF ID is protected, however, allowing the FF ID to get locked could result in unnecessary delays during an emergency situation.

FYI - we are on SP08, in a CUA environment. we have also implemented note 992200 which was supposed to prevent dialog login, but it only prevents the dialog login when the correct password is entered.

Regards,

Catherine

[Former Member]

Creating a SYSTEM type user will not work, because the system will not attach a SAPGui session to the user context session via the RFC call.

> FYI - we are on SP08, in a CUA environment. we have also implemented note 992200 which was supposed to prevent dialog login, but it only prevents the dialog login when the correct password is entered.

Not exactly correct - after a sucessfull login, the exit checks whether the FF ID is already doing Chuck Norris roundhouse kicks within the system. If so, it rejects the second login to prevent 2 terminals using the same FF ID.

The user type was SERVICE before to prevent it from changing it's own password, as the password has been saved in a decryptable format which was not changed at each login. This mechanism has been changed now.

See for more detailed information and a solution.

Please leave the user type as SERVICE. The password will be changed at each use of the FF ID anyway, and an idle user (no emergencies) will not delete it's password, as is the case with DIALOG users. If you change it to DIALOG, then the FF ID can also change it's own password again after invoking the login. Additionally, the requesting SAP user would potentially inherit logon tickets for other systems if they are setup in trust chains. SERVICE and SYSTEM users have functional restrictions. This is a security feature.

Cheers,

Julius

[Former Member]

Hi,

Try creating a SYSTEM user instead of SERVICE user, if FF accepts that ID that should solve your issue...

don't have the GRC System in front of me to test it out....

If the FF ID switching is not done in Dialog user mode then it should work.. else it may not....just try out and let me know

Cheers !!

Zaheer

Edited by: Zaheer on Oct 8, 2009 6:57 AM