SU01| How to make user group mandatory - the official solution

[Bernhard_SAP]

Asked / required many times (for instance in http://scn.sap.com/thread/208126 , http://scn.sap.com/thread/2015535 ,etc.) SAP offers, beyond other security related improvements for SU01 regarding S_USER_GRP, the possibility now, to make the user group field on the logon data tab a mandatory field in standard.

Please check SAP note 1663177 for more details.

b.rgds, Bernhard

[martin_voros]

An English version of note would be nice. Anyway, it sounds good.

Cheers

[Bernhard_SAP]

sorry for that, translation is not finished yet.... I did not check that 

19.04.2012:

english version now available!

https://websmp101.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=1663177&_NLAN...

Message was edited by: Bernhard Hochreiter

[Former Member]

Note is a good update. Thank you.

Regards,

Ajesh.

[Former Member]

I have been looking for this solution for a while.

Can someone confirm my interpretation of the note?

New ID's created without a user group will be assigned the default user group. When changing an ID which includes password changes, if no user group exists the change is not saved.

What are the implications if we are currently using GRC 5.3 (upgrading to 10 shortly), SAP 4.6C (upgrading to ECC6 shortly).

Is it possible to make any other fields mandatory on the address tab or logon data tab?

Thank You,

Chris

[Bernhard_SAP]

Chris Hall wrote:
New ID's created without a user group will be assigned the default user group. When changing an ID which includes password changes, if no user group exists the change is not saved.

-->if you have set the field as 'mandatory'-->correct

Chris Hall wrote:
 What are the implications if we are currently using GRC 5.3 (upgrading to 10 shortly), SAP 4.6C (upgrading to ECC6 shortly).

-->maybe you can ask this in the GRC-forum? I am not sure, if GRC uses our user-bapis for every function....

Chris Hall wrote:
 Is it possible to make any other fields mandatory on the address tab or logon data tab?

-->not in standard, but with the possibility of transaction variants as described already in other threads.

b.rgds, Bernhard

[Former Member]

Hello Chris,

What are the implications if we are currently using GRC 5.3 (upgrading to 10 shortly), SAP 4.6C (upgrading to ECC6 shortly).

"S_USER_GRP is required for the FF role. As per the GRC 5.3 sec giude:

S_USER_GRP ACTVT

Group

02, 03, 05

[FFID’s User Group]"

but... I disagree with the following recommendation in the sec. guide:

"If the FFIDs are not in a unique User Group, we recommend you assign them to a group.

n If it is not possible to change or assign a user group to the Firefighter IDs, then a value of ’*’

can be assigned to CLASS."

Why don't just give CLASS=' ' ??

Cheers,

Diego.

[Former Member]

Dear Bernhard,

Presently, we are on SAP BASIS release 701 with supprt package 07. As per SAP NOTE 166317,

What  i understand, Once we install support pkg: 112, user group field become mandatory option itself.

Please suggest!!!!!!!!!!!!!!

[Former Member]

   Can I get reply for my query!!!!!!!

[Former Member]

Sumit,

If you meant SP12, the answer is yes. The corrections of the note are included in SAPKB70112.

Cheers,

Diego.