Profile Parameters for Logon

To make the parameters globally effective in an SAP System (system profile parameters), set them in the default system profile DEFAULT.PFL. However, to make them instance-specific, you must set them in the profiles of each application server in your SAP System.

To display the documentation for one of the parameters, choose Tools >> CCMS>> Configuration >> Profile Maintenance (transaction RZ10), specify the parameter name and choose Display.

Password Checks

Parameters	Explanation
login/min_password_lng	Defines the minimum length of the password. Default value: 3; permissible values: 3 – 8
login/min_password_digits	Defines the minimum number of digits (0-9) in passwords. Default value: 0; permissible values: 0 – 8 Available as of SAP Web AS 6.10
login/min_password_letters	Defines the minimum number of letters (A-Z) in passwords. Default value: 0; permissible values: 0 – 8 Available as of SAP Web AS 6.10
login/min_password_specials	Defines the minimum number of special characters in the password Permissible special characters are ()!\"@ $%&/()=?'`*+~#-_.,;:{[]}\\<> Default value: 0; permissible values: 0 – 8 Available as of SAP Web AS 6.10
login/min_password_diff	Defines the minimum number of characters that must be different in the new password compared to the old password. Default value: 1; permissible values: 1 – 8 Available as of SAP Web AS 6.10
login/password_expiration_time	Defines the validity period of passwords in days. Default value: 0; permissible values: any numerical value
login/password_change_for_SSO	If the user logs on with Single Sign-On, checks whether the user must change his or her password. Available as of SAP Web AS 6.10, as of SAP Basis 4.6 by Support Package
login/disable_password_logon	Controls the deactivation of password-based logon Available as of SAP Web AS 6.10, as of SAP Basis 4.6 by Support Package
login/password_logon_usergroup	Controls the deactivation of password-based logon for user groups Available as of SAP Web AS 6.10, as of SAP Basis 4.6 by Support Package

Multiple Logon

Parameters	Explanation
login/disable_multi_gui_login	Controls the deactivation of multiple dialog logons Available as of SAP Basis 4.6
login/multi_login_users	List of excepted users (multiple logon) Available as of SAP Basis 4.6

Incorrect Logon

Parameters	Explanation
login/fails_to_session_end	Defines the number of unsuccessful logon attempts before the system does not allow any more logon attempts. The parameter is to be set to a value lower than the value of parameter login/fails_to_user_lock. Default value: 3; permissible values: 1 -99
login/fails_to_user_lock	Defines the number of unsuccessful logon attempts before the system locks the user. By default, the lock applies until midnight. Default value: 12; permissible values: 1 -99
login/failed_user_auto_unlock	Defines whether user locks due to unsuccessful logon attempts should be automatically removed at midnight. Default value: 1 (Lock applies only on same day); permissible values: 0, 1

Initial Password: Limited Validity

Parameters	Explanation
login/password_max_new_valid	Defines the validity period of passwords for newly created users. Available as of SAP Web AS 6.10, as of SAP Basis 4.6 by Support Package
login/password_max_reset_valid	Defines the validity period of reset passwords. Available as of SAP Web AS 6.10, as of SAP Basis 4.6 by Support Package

SSO Logon Ticket

Parameters	Explanation
login/accept_sso2_ticket	Allows or locks the logon using SSO ticket. Available as of SAP Basis 4.6D, as of SAP Basis 4.0 by Support Package
login/create_sso2_ticket	Allows the creation of SSO tickets. Available as of SAP Basis 4.6D
login/ticket_expiration_time	Defines the validity period of an SSO ticket. Available as of SAP Basis 4.6D
login/ticket_only_by_https	The logon ticket is only transferred using HTTP(S). Available as of SAP Basis 4.6D
login/ticket_only_to_host	When logging on over HTTP(S), sends the ticket only to the server that created the ticket. Available as of SAP Basis 4.6D

Other Login Parameters:

Parameters	Explanation
login/disable_cpic	Refuse incoming connections of type CPIC
login/no_automatic_user_sapstar	Controls the emergency user SAP* (SAP Notes 2383 and 68048)
login/system_client	Specifies the default client. This client is automatically filled in on the system logon screen. Users can type in a different client.
login/update_logon_timestamp	Specifies the exactness of the logon timestamp. Available as of SAP Basis 4.6

Other User Parameters

Parameters	Explanation
rdisp/gui_auto_logout	Defines the maximum idle time for a user in seconds (applies only for SAP GUI connections). Default value: 0 (no restriction); permissible values: any numerical value

Composite Role

1. A composite role is a container with several different roles. For reasons of clarity, it does not make sense and is therefore not allowed to add composite roles to composite roles. Composite roles are also called roles.
2. Composite roles do not contain authorization data. If you want to change the authorizations (that are represented by a composite role), you must maintain the data for each role of the composite role.
3. Creating composite roles makes sense if some of your employees need authorizations from several roles. Instead of adding each user separately to each role required, you can set up a composite role and assign the users to that group.
4. The users assigned to a composite role are automatically assigned to the corresponding (elementary) roles during comparison.

Derived roles

1. Derived roles refer to roles that already exist. The derived roles inherit the menu structure and the functions included (transactions, reports, Web links, and so on) from the role referenced. A role can only inherit menus and functions if no transaction codes have been assigned to it before.
2. The higher-level role passes on its authorizations to the derived role as default values which can be changed afterwards. Organizational level definitions are not passed on. They must be created anew in the inheriting role. User assignments are not passed on either.
3. Derived roles are an elegant way of maintaining roles that do not differ in their functionality (identical menus and identical transactions) but have different characteristics with regard to the organizational level.
4. The menus passed on cannot be changed in the derived roles. Menu maintenance takes place exclusively in the role that passes on its values. Any changes immediately affect all inheriting roles.
5. You can remove the inheritance relationship, but afterwards the inheriting role is treated like any other normal role. Once a relationship is removed, it cannot be established again.