Avoid HANA DB user being locked

[former_member601762]

Hi Guys,

We have a specific HANA DB user, which is shared with many developers. We want it to avoid being locked even after several unsuccessful logon attempts set in the system.Is it possible?

Thanks

[pfefferf · Accepted solution]

To avoid that a user is locked after reaching the Number of Allowed Failed Logon Attempts setting of the password policy, you have to set the User Lock Time setting in the password policy to 0. But as this would have an effect to all users, you should create a specific user group for that user, to restrict the change to just this user. E.g.

-- create user group
CREATE USERGROUP UnlockableUser SET PARAMETER 'password_locktime' = '0' ENABLE PARAMETER SET 'password policy';

-- assign user group to user
ALTER USER <your user> SET USERGROUP UnlockableUser;

In general your approach by using just one user for different people should be avoided, because that is the wrong approach for a good user management and it opens graps regarding security/transparency/controlling/...

[RobMoore · Accepted solution]

Needed a similar solution so I tried this:

1) Typo in Create UsrGrp SQL - needs to be "password_lock_time"

2) Adding a user to such a user group doesn't actually stop them being locked/disabled because the Maximum_invalid_connect_attempts parameter causes the user to be disabled anyway, regardless of the lock time invoked.

So... I am bit stuck - considering changing the Max Invalid attempts to 99 (currently it is 6) to try and help.

Is there not the concept of a "Service" user in SAP HANA or some controlled way of providing a 'generic' profile? Any ideas gratefully received 🙂