User Copy & User Password Copy

[Former Member]

Hi. Guru...

I'd like to copy user id according to a new user id coding rule.

When I copy current use ids to new ones, I want to assign the same password to each user.

How can I copy user id with the same password?

I'll use CATT to copy user ids.

Can I get the result that I want if I put the same data related with password to Table USR02?

Edited by: Seung Won Lee on Jul 2, 2008 8:59 AM

[Former Member]

Moved to security forum...

[Former Member]

> Can I get the result that I want if I put the same data related with password to Table USR02?

No.

[Former Member]

The encoded password in field USR02-BCODE is determined based on the user ID and will not be identical for another user. It will, however, be identical for the same user across systems; meaning you can create a new, identical user in another system and force the same password by using the value for BCODE... which is an interesting point in itself.

As for copying users, use the BAPI's designed for this task (BAPI_USER*).

[Former Member]

And in higher releases it is even less possible. The user cannot change their password more than once per day, and if they or the admin were to reset their password to the same clear text value, a different hash would be produced for the same user ID. So the hash has a uniqueness to the system, the client and the user.

In addition, updating USR02 is not only a risky idea with LOTS of room for error and misunderstandings, it is also blocked in future releases, so one might as well get used to using BAPIs now already

Cheers,

Julius

[Former Member]

The hash value is actually both system- and client-independent, at least for WAS versions up to around 6.40... we've fiddled around with it sufficciently to know that much. I can only welcome stricter policies from SAP in that respect...

Trond

[Former Member]

Hi Trond,

It sounds to me as if you were looking for a problem in your 6.40 WAS and not a solution, because the new hashing mechanism was already introduced in release 6.40.

Also in the latest releases the old mechanism you are referring to is optionally available. SAP left BCODE largely intact for those who wish to keep it, and introduced a new hash using a SHA-1 algorithm and a "salt" in it (though I like to think of it as "poison" for those who do updates to USR02-PASSCODE).

You can choose between combinations of these options using param login/password_downwards_compatibility.

Cheers,

Julius

[WolfgangJanzen]

>

> ...  introduced a new hash using a SHA-1 algorithm and a "salt" in it (though I like to think of it as "poison" for those who do updates to USR02-PASSCODE).
> 

Just to mention it: USR02-PASSCODE is also using a (deterministic) salt which is calculated based on the input data (cleartext password AND userid). Like USR02-BCODE you cannot copy the content to another user record (differerent USR02-BNAME) and expect that both users would then have the same password (the copied user record will have an invalid password hash).

[WolfgangJanzen]

>

> How can I copy user id with the same password?
>

That's not supported because there is no real use-case for that.

In general it is not desired that multiple users have the same password - a password is supposed to be private for one particular user (notice: the user is not supposed to write down the password or tell it to others).