Dont want password change with SSO login ?

[Former Member]

Hello,

i have following problem.

We have an portal and jump with SSO ticket to the backend system BW (ABAP + JAVA).

Login with SSO works fine.

The mainly users are portal user and we dont want that password change screen comes wenn expire after 90 days.

For sapgui user it is ok.

So we put the paramter login/password_change_for_SSO= 0 into ABAP instanz and after password expire SSO login for example to ICM works fine without complaining to change passwor.

The portal users are jumping to the java instance of BW backend. User management of java is in the abap instance.

When passwor expire the user become screen to change password.

We dont want that like !!!

I thought that the parameter login/password_change_for_SSO= 0 works also vor java because they have same

user management ihn abap.

Does anybody head same problem ?

Solution ?

Regards. H.Thauer

[tim_alsop]

Have you tried changing the UME property called ume.logon.force_password_change_on_sso. The default for this property is true, so you could try changing it to false.

Thanks,

Tim

[Former Member]

Hello,

i changed the parameter ume.logon.force_password_change_on_sso to fales an now it is working.

But now i have some other side effect. Wenn i create an new account ihn the backend BW system with

initial Password, the system does not prompt to change initial password !

I want that when i come from portal with SSO system only ask to change passwor if initial ?

If there is no solution i will open an oss call.

Thanks and regard H.Thauer

[tim_alsop]

Heinrich,

Surely if you are using SSO (e.g. external authentication) then you don't want a user to be able to change their password in the back-end BW system ? Instead, the users password which they use to authenticate with before logging on to portal will be all that is needed - the backend system needs to recognise SSO2 ticket only and not userid+password.

Thanks,

Tim

[Former Member]

Have you seen SAP Note 869218 and the discussions here around this SSO from Java systems to backend ABAP user stores?

The same note number is a good search term and check your release and SP levels.

If you give the users this option, then it might be advisable to still delete an idle productive password at some point... this is however a global setting for all users in all clients.

Cheers,

Julius