password self service

Generated by Jive on 2014-12-30+01:001

Password Self Service & End User LogonConfiguration - AC10

GDay All,

Given the importance of Password Self Service and End User Logon, numerous posts out here in regards to itsconfiguration and problems, coupled with my own interest in it; I began scouring through all the blogs relatedto these two topics and the result is as follows. I hope this will help you to some extent in understanding andconfiguring PSS and EUL.

As usual please free to correct me, if I made any mistakes or if you would like to add anything to this document.

Password Self Service

Password Self Service is a customizing activity, which enables an end user to reset their own passwordsin the back end system. A user password is usually reset using TCode SU01. However considering this isrestricted to end users and to help admins from being bogged down by constant password reset requests, agood alternative is to give the end user the option to reset their passwords themselves thereby freeing up theadmins to do other tasks.

When an end user raises a request for a password reset, the application verifies the user basedon the information they maintained for their password self-service settings or against the globalPSS settings. Once the application verifies the user and the system, it resets the passwordand sends an e-mail to the users configured e-mail address. The password sent is a genericpassword, which the user needs to change upon their login.

* All end users need to have a valid email Id to receive reset password linkPassword Self Service Configuration

Connector Settings Maintain Connector Settings: For each applicable system tick the PSS System Box

SPRO -> IMG -> GRC -> AC -> Maintain Connector Settings

Password Self Service & End User Logon Configuration - AC10


Maintain Data Sources Configuration: Choose which system you check, for User Id to login SPRO -> IMG -> GRC -> AC -> Maintain Data Sources Configuration

User Authentication Data Sources: Pick a System (ECC, LDAP, HR etc) User Search Data Sources: Pick a System (ECC, LDAP, HR etc) User Detail Data Sources: Pick a System (ECC, LDAP, HR etc) End User Verification: Choose YES/NO for Password requirement on logon screen

Enabling End User Verification would require the end user to enter their password in order to login.However if a user needs to request a new password (obviously they forgot the current one), it would bea catch 22 situation as pointed out by Colleen further down in the document (comments section).

Disabling End User Verification would rectify this problem however that would raise asecurity issue, where any user can login using someone elses user id and access theirhome screen and raise requests etc. This isnt a huge problem as the request would go tothe email address registered against their user id but still can be frowned upon and shouldbe discouraged.

A good compromise would be to Disable End User Verification and activate Challengerquestion (covered further down in the document). Even this has one potential downside toit, which is, if the end user hasnt registered their answers against the questions then theprevious scenario would come into play again!! So any suggestions from the seasoned community members here, who had to deal with this issue

would be very much appreciated!

* You can configure multiple data sources. Preference is set by giving a sequence number



Password Self Service Settings Run transaction SPRO.

SPRO-> IMG -> Governance, Risk & Compliance -> Access Control -> User Provisioning -> MaintainPassword Self Service On the left panel, under Dialog Structure, click PSS Global Configuration Values folder Click New Entries button. Under the PSS Global Configuration Values, enter the following:

Authentication Source = Challenge Response When you select this option, the administrator configures the security questions and

the users register their answers. A user who creates a request to reset their passwordmust answer the questions as they have registered them. The application only resets thepasswords if the user successfully answers all of the questions

PSS Disable Verification = None: Select this option if you want to enable PSS verification. Name Change Self Service: Select this option if you want to disable PSS verification in

case the user only changes their name. Password Self Service: Select this option if you want to disable PSS verification in case the

user changes their password. All: Select this option if you want to disable PSS verification in all situations. By choosing

'ALL', user would not need to register questions or receive a step in the password resetprocess to answer any questions.



To answer a question/be challenged. Number of Questions = 2 (Minimum should be 1) Number of Attempts = 3 (For Example)

Click Save button. On the left panel, click the Challenge Response Questions folder.

Click New Entries button. In the Challenge Response Questions, enter a Question in the field provided. Check the Active box. Click Save.

* If you chose HR System as the authentication source, then maintain the PSS HR System settings.

End User Logon

An employee within an organization would require, to raise various types of requests like anAccess Request for a new account/change an existing account etc or reset their own passwordetc on a regular basis. End User Logon, facilitates this by giving them access to their own HomeScreen, where they can raise the relevant requests.

In this instance, the end user would need access to raise a request to reset their own password. In order toachieve that he/she would need authorization to be able to access it and following steps needs to taken toaccomplish that.

End User Logon Configuration



User Maintenance A shared User needs to be created and the same user details should be maintained in Web Services

(explained further in the document) Create a Shared user in SU01 Should be of type communication with the following two roles:

SAP_GRAC_ACCESS_REQUESTER SAP_GRAC_END_USER

A WF-Batch user needs to be created as well. The email to the end user is sent from the email addressconfigured against this user Create WF-Batch user in SU01 Should be of type 'System' You can configure the email address as '[email protected]' so end users do

not respond or email this address directly.

* Shared User: Has to exist in the GRC system

Activate End User Logon Run Transaction SPRO

SPRO -> IMG -> GRC-> AC-> User Provisioning-> End User Login: ServiceName =GRAC_UIBB_END_USERLOGIN or enter tcode SICF Under the Virtual Hosts/Services section, double-click GRAC_UIBB_END_USERLOGIN to open it

in edit mode. The Create/Change a Service screen appears.



On the Logon Data tab, enter the shared user id, password (you created in SU01) and procedure(Standard) -> Save



Repeat steps 1-3 for the following Web Services:1. GRAC_GAF_PWD_SELFSERVICE_EU2. GRAC_OIF_USER_REGISTER_EU3. GRAC_OIF_MY_PROFILE_EU4. GRAC_GAF_NAME_CHANGE_SERV_EU5. GRAC_POWL_REQUEST_STATUS_EU6. GRAC_GAF_ACCREQ_WITH_REQREF_EU7. GRAC_OIF_REQUEST_SUBMISSION_EU 8. GRAC_GAF_ACCREQ_WITH_TEMPL_EU 9. GRAC_GAF_ACCREQ_WITH_USEREF_EU

Right-click GRAC_UIBB_END_USERLOGIN, and then choose Test Service -> Logon Screen in webbrowser.

* Only the first 3 services might suffice if you are enabling just PSS however I've had someproblems (covered in the 'Errors' section) and enabling all 10 seem to address those issues, so ifyou encounter any problems you might give this a go!!



If you would like to disable certain objects you can do so by adding the following line to end of theweb address in the URL window of the browser and press enter.

&SAP-CONFIG-MODE=X&OBJECT_ID=ACCREQ/123 Following screen shows up. If you see Adapt Configuration on the top, right hand

corner; that means you are in config mode.

Enter your username and password, and log onto the system. The End User Home screen appears.

To make a link invisible, right-click the link and select Settings for Current Configuration. Select Invisible, Save the entry, and then close the browser. The link is no longer available for end users. This is applicable for all end users.



User AccessYou got to give the end user the URL address, User ID and Password so they can use those credentialsto login and raise a request. Once they login they can raise a request to reset their password. If request issuccessful then the system sends them an email with a temporary password, which they need to changeupon their login. The password generated is a system generated one. The email received by the user lookssomething like this:

You can customize the generic password sent by executing: TCode: SM30 Table: PRGN_CUST - > Maintain -> New Entries -> Add the following Names and corresponding

values you are after and Save. GEN_PSW_MAX_LENGTH GEN_PSW_MAX_LETTERS GEN_PSW_MAX_DIGITS GEN_PSW_MAX_SPECIALS

End result is as follows with the following customized values: GEN_PSW_MAX_LENGTH: 10 GEN_PSW_MAX_LETTERS: 5



GEN_PSW_MAX_DIGITS: 3 GEN_PSW_MAX_SPECIALS: 2

Errors

End User Logon ScreenSometimes NWBC logon screen shows up as opposed to EU logon screen! Maintain all 10 Web Services and ensure the Logon Data details(User ID, Password) are exactly the

same in SICF!!

Re-login ScreenWhen user clicks on one of the services in the Home Screen, it asks for username and password again! Again same solution as above!!



Systems not showing upWhen the user clicks on the add button to add a system in PSS request, no systems are available! This could be a problem with connectors not defined properly in Maintain Connector Settings or

PSS isn't enabled against that connector. Try giving the Shared user 'SAP ALL' authorization. This seems to do the trick sometimes,

however I am not sure if this is the right approach.

For best practices, pitfalls to avoid and things to consider while enabling PSS, please refer to the followingdocument put together by Col and Ale. Thanks Guys!!

Design Considerations to reduce Password Self Service (PSS) Intruder Risk

Regards,Leo..

password self service

Documents