Howto disable direct login into DB server

[former_member185954]

Hello Experts,

I have a very old system with me(SAP 4.0B running on AIX/Oracle DB) which has 7 application servers, however there is too much load on all servers.

I wish to restrict users logging directly onto the DB server.

Is there a way to disable users login into DB servers, I know about SAP logon groups, however a user would still be able to bypass it by configuring direct connection in the saplogon.

There could be a parameter perhaps that I don't recollect right now !

Any help is appreciated.

Regards,

Siddhesh

[Former Member · Accepted solution]

Hello Siddhesh,

Using the dialog logon user exit SUSR0001, you can add your custom checks to logon procedure.

You have to enable the logon user exit using SAP enhancements (CMOD transaction) and write your ABAP code to check the users.

Regards

Ermanno

[former_member185954 · Accepted solution]

Hi Ermanno,

I was aware of this solution, but didn't have detailed knowledge about it , cause I am primarily a Basis guy.

I have assigned some points to you currently, I will check with my ABAPers and let you know.

Meanwhile I'll keep the question open, just in case if someone has some parameter or some other easier option available..

Thanks again.

Regards,

Siddhesh

[Former Member · Accepted solution]

Hello Siddhesh,

take into account that no special parameters or settings exist for your issue, so I think ABAP way is the best way.

Please refer to SAP notes 12466 and 106388, in order to get some guidelines about user exit SUSR0001 and SAP enhancements, in particular note 106388 explains how to log off a user (I think it could be precious for your ABAPers).

Regards

Ermanno

[former_member185954 · Accepted solution]

Hi ermanno,

I have forwarded the solution you suggested to our customer.

Thanks for your response, I have marked the question as answered

Regards,

Siddhesh

[Former Member]

If you cannot do ABAP change -

You have to ensure that no direct logon is configured on users SAPLOGON.

Then disable SAPlogon edit functionality from users machines and give then access to SAPLOGONPAD only.

This way they cannto change saplogon configuration.

Also, you can put saplogon.ini on the network where all users can only read it.

And configure their saplogon's to connect to this ini file.

[former_member185954]

Hi Amol,

Thanks for your reply, I am aware of this solution.

We have about 15,000 users, the system is real big, the approach you suggested is not feasible !

Regards,

Siddhesh

[Former Member]

Sid,

Check with your network team if they can isolate your database server from other systems but application servers. Something to do with dual n/w cards... I dont know much abt n/w but remember this was configured at one of the clients I worked before...

[former_member185954]

Amol,

When you have servers which are global any kind of modification to something as critical as networks can result into fatal outage, network modification is not an option.

Thanks for your feedback although!

I think the user exit is the only option here.

Regards,

Siddhesh