Mixed case passwords for CPIC user.

[Former Member]

Hi,

One of our customers would like to use mixed case passwords for CPIC user. In our in-house research we found that when

login/password_downwards_compatibility is set to 4 we could use mixed case passwords for CPIC user.

We found an article (http://help.sap.com/saphelp_nw04s/helpdata/en/22/41c43ac23cef2fe10000000a114084/content.htm) for login/password_downwards_compatibility but we would like to know the following

1. Whether setting the option to 4 is an advisable one

2. The significance of setting this flag.

3. Will this lead to any security problems.

4. Is setting this option is the right method to use CPIC mixed case passwords?

5. Any SAP notes or articles that will explain in detail about this option.

Thanks,

Sunil

[Former Member]

Did your "inhouse research" include reading the documentation in RZ11 and the SAP notes on the topic?

I think you are on the wrong track here...

Cheers,

Julius

[WolfgangJanzen]

>

> 5. Any SAP notes or articles that will explain in detail about this option.

See: [SAP Note 1023437|https://service.sap.com/sap/support/notes/1023437] and [SAP Note 807895|https://service.sap.com/sap/support/notes/807895].

[Former Member]

> > 5. Any SAP notes or articles that will explain in detail about this option.

>

> See: [SAP Note 1023437|https://service.sap.com/sap/support/notes/1023437] and [SAP Note 807895|https://service.sap.com/sap/support/notes/807895].

Thing is (in my interpretation) that Sunil does not want to know how it works but rather how to get there for existing users with password based RFC authentication for whom the password is not known and whether '4' is the correct setting for this.

Quite obviously it is not, hence I am wondering what this "inhouse research" was...

A trick which can be used (thanks to the parameter being dynamic, except for 0 in some release levels...) is to set it to '3' and then do an "Authorization test" in SM59 on each connection once. If any of them are recorded in SM21, then you know that the upward compatibility failed and downward compatibility was required.

But it still does not tell you the reason nor the password itself... so you still have to fix that (which might not be possible anyway).

From my experiences, it is much easier and less disruptive to correct the cardinality of the connections with a new user (this is advisable anyway..), and then set a cryptic password with 1 or 2 random special characters and in the target system use UPPER-CASE passwords for downward compatibility when you know it will be required...

Then you can set login/password_downwards_compatibility = 0 and reset the passwords, as a single user ID does not force all others into less secure and globally forced settings (and passwords).

> 2

> ...

> This is recorded in the system log. The logon fails. This setting is to allow the identification of backward incompatibility problems.

>

> 3

> As with 2, but the logon is regarded as successful.

Cheers,

Julius