GRC-SPM Firefighter S_USER_GRP 05 (Lock\Unlock) authorization issue

[Former Member]

Iu2019ve the following question for the group for GRC-SPM:

Q: Is S_USER_GRP = 05 (Lock\Unlock User) authorization a must for a Firefighter User in order to check out the Firefighter ID? (My testing shows it is!)

If yes, how will you prevent users from changing passwords for other Firefighter users and Business users in production?

Note: Not all Firefighters will have SU01 or SU10 tcodes, but Role stacking (combinations) or transaction ranges could create a risk as there are multiple ways in SAP to update a user.

Also, we are thinking about using User Groups to limit the access but weu2019ll still need to have separate Firefighter role for Basis & Security from other Firefighters in that case.

Is there a way to deactivate the S_USER_GRP = 05 authorization check in the system to avoid this issue? Has anyone implemented anything like this yet?

Thanks,

Mandeep

[Former Member · Accepted solution]

Hi Mandeep,

Yes, the S_USER_GRP chcek is mandatory. THe best thing to do would be to use user groups and assign a particular group to your firefighter. I guess you could assign the same group to S_USER_GRP for the FF authorization.

Regards,

Chinmaya

[Former Member · Accepted solution]

Thanks Chinmaya!

Do you know the function module where the S_USER_GRP authorization check takes place for Firefighter\SPM?

Is there a User Exit or BADI available for custom implementation or can you de-activate this check?

Is it even reccomended? If not, why?

Thanks,

Mandeep

[Former Member · Accepted solution]

Hi Mandeep,

I couldnt really find it... but I would not really change a SAP standard code for this.

Regards!

Chinmaya

[Former Member]

Virk,

Although your question is answered, just wish to add few point.

In earliar version of SPM, it was mandatory to maintain password in SPM.

However with latest version maintainance of password is no more compulsary in SPM.

Now SPM handle password change or reset (if required) internally.

and for doing that 05 is MUST.

This applies to SU01, if you want to reset any password.

Regards,

Surpreet

...... my 2 cent......

[Former Member]

Cool, this helps a lot Surpreet and it makes sense now why we should not deactivate 05 check!

Thanks,

Mandeep

[koehntopp]

It seems you have not finished post-installation.

Note 992200 implements a user exit that prevents users logging in with FF IDs which will solve your issue.

Frank.

[Former Member]

Hi Frank,

Note# 992200 does not apply for our version VIRSANH 530_710 installed for PI (Process Integration) system.

I searched if there was another note but could not find any.

Does SAP need to put a correction for version VIRSANH 530_710 yet?

Please let me know.

Thanks,

Mandeep

[koehntopp]

Are you sure? Maybe they just forgot to update the note...

[Former Member]

Hi Frank,

Thanks for your reply!

May be SAP did forget to update the note to include the latest version VIRSANH 530_710, version VIRSANH 530_700 is listed there but NOT 710!

I think we can still implement the change? Don't you think?

Regards,

Mandeep Virk

[Former Member]

Hi Frank,

You were correct, I checked and confirmed with SAP .... Note# 992200 is applicable for VIRSANH 530_710 as well.

Thanks,

Mandeep

[Former Member]

Thanks, I agree!