login/password_logon_usergroup maintenance

[former_member199412]

Hello Guys,

I would like to ask you all a question...i have configured a SSO scenario with an active directory, a Sap portal with spnego module and the sap systems as backends. It is working fine, no problems.

from portal to sap backend we use a sap shortcut.

but i have a doubt...i want to configure the SAP systems (abap) in order to allow some user to have access with the user/pass method. The rest of the users should access with SSO.

I have set the following parameters:

login/password_logon_usergroup SUPER

login/disable_password_logon 1

so only the users with the "SUPER" group assigned, can access with user / pass.

I am trying to assign the "SUPER" group to more or less 100 users in "su10" tcode but it is not working fine...i select the users in su10 tcode, click in change button, in "User group for authorization check" I fill the gap with the "SUPER" group and then save changes.

But in the SU01 tcode, if i choose one of these users i can not see the group in the "User group for authorization check" area.

Is there any way to change this property massively??

Is there any way to not allow the users to logon in the sap system with user/pass??

Many thanks in advance and regards!

Gonzalo.

[Former Member]

What does the SU10 log tell you?

Can you change it in SU01?

Possibly you are missing authorizations?

Anyway, here is a trick for you to workaround the single group problem and this one: In SU01 / SU10 set the logon language on user data tab to 'ZZ' (as in "Zimbabwe Zombie-speak") and save. This is not known to SAP and the SSO stops in the logon screen...

Cheers,

Julius

[former_member199412]

Hello Julius,

Many thanks for your help. In the su10 log, everything appears to be ok. I think it is a "support package" problem. I have tested it in another server (with high level of SP) and it works fine...

hahaha the "Zimbabwe Zombie-speak" is a good trick!! but mi problem is to not allow the users to logon into the sap system without SSO.

cheers,

Gonzalo.

[martin_voros]

I think that what Julius is meant is that you will disable password logon (parameter login/disable_password_logon) and you will set logon language to ZZ for those users who you want to give access with password. SSO gets confused with undefined language and it displays logon screen. You have a simple workaround for your SU10 problem. Obviously, this is just a workaround.

BTW thanks Julius for sharing this neat trick.

Cheers

[former_member199412]

Hello Martin,

you are right!! it is a gook trick!! i have solved the problem applying support packages.

Many thanks for your help.

Gonzalo.