How to track IP address and other details of a user who did some mischief using his portal account

[Former Member]

Hi friends,

Our organization is fairly new to SAP and I am a part of our employee portal team. The SAP is implemented through intranet in all our offices. The employee portal is used by employees to mark their attendance, apply for leaves, check their monthly salaries etc. Recently, an issue was detected where some employees marked their attendance even though they were not present in the office. Obviously this was done by password sharing.

In order to clamp down on such practices, the portal team has now been entrusted with the task to submit a report on the matter and to trace the IP addresses from which such incidences have taken place. We need help in following matters:

1. A detail of portal tables, where they are stored and how to access them directly ? The standard reports are of no use to us.

2. In which table the IP addresses are stored and under what field name ?

3. Whether information like how many times a particular user has accessed his portal account on a given date or in a given date range alongwith respective IP address can be generated using these tables ?

Many thanks in advance for help.

Regards,

Vikas Bansal,

Delhi.

[Former Member]

Vikas,

You can check with your infra guys on what Tobias has proposed!

Or the Web Analytic Tools could be good option if you want application (iView/Page) level tracking, but certianly not for tracking the visitor's IP address (as-per PII). As its for INTRANET usage, you could check/search for such tools by looping your infra and BASIS teams.

Google Analytics - doesn't store IP address

PIWIK - it does,... check it and its privacy at http://piwik.org/privacy/

Or search for more..!

Thanks,

MS

[hofmann]

As the employees shared their credentials, the focus should be laid on that issue. Something is seriously wrong when they give their credentials to others just to make their time report, both from a employer and culture perspective.

For the portal part, you can get the IP of the computer used to access a specific URL, but if the default configuration was applied, that's all you'll get.

[amolgupta]

hi Vikas,

You should try to regulate crucial accessed through Portal roles. In SAP servers, important objects are secured by regulating access.

For example - normal users should not have User Administration, Content Administration or System Administration rights.

Portal users can only access content according to Roles provided to them. Dont give normal business users elevated roles which are not needed by them. Doing otherwise can be fatal and equivalent to arming monkeys with guns ! Tracking IPs can only help you punish culprits after damage is done !

Regards,

-Amol

[Former Member]

Hi Amol,

You have rightly pointed out the security aspect. We are already controlling user access by appropriate roles. None of mischief mongers have admin rights, they are normal users. But the fact that their password sharing led to the incidence of marking their attendance without their actually attending the office is troublesome and indeed invites action from management. In this context we need to trace these offending IPs on our intranet.

The problem is that transactions like STAD, st03n etc capture the IPs of online users and that too R3 users and not the portal users. Our need is to capture portal users' IP address.

Regards,

Vikas.

[Qualiture]

Hi,

You could use the Session Monitoring tool in NWA

See http://help.sap.com/saphelp_nw73/helpdata/en/5e/2533321f1d4de9b52e7a18eaecf109/content.htmfor more details

[Former Member]

Hi Robin,

Many thanks for your answer. Your solution provides for the tracking of any user activity when the said user is logged into his portal account. We are looking for tracing an IP address anytime after the user has logged off his portal account.

Regards,

Vikas.

[amolgupta]

Hi Vikas,

Since you mentioned that you wish to implement foolproof attendance system. Given instances of malpractices followed by users, using the Portal for registering attendance may not be solve the purpose in its true spirit. Even if you are able to track IPs, next malpractice that will come up is that Proxy users will go to absent users desktop and log in using shared credentials and register attendance.

One potential solution can be using biometric systems like thumb impression recognition system which have recently become very common and cost effective too.

Thanks and  Regards,

-Amol Gupta

[Former Member]

Hi Vikas,

I actually wanted to point the same thing highlighted by Amol, if we restrict the proxy users by tracing the IP addresses, there is always a way to malpractice the same by directly using the desktops by sharing its credentials! But this might avoid the malpractice to some extent, and looking at your requirement you might need something 100% foolproof solution.

I'm not sure how big/size of your organization, but the below would resolve you issue (if not in practice now):

- implement by recording attendance data by swipe in/out using magnetic id cards, or bio-metrics etc..

- integrate the recorded daily attendance data with SAP Time Management, this will record the actual working hours of employees (there are many SAP implementations with this practice currently in use)

And let me look at the IP tracing thing, would come if find anything interesting!

Thanks,

MS