Organisationally restrict table editing permissions
Search for user and password locks
The passwords of the users are stored in the SAP system as hash values. The quality of the hash values and thus their safety, however, depends on the hash algorithms used. The hash algorithms previously used in SAP systems are no longer considered safe; They can be cracked in a short time using simple technical means. You should therefore protect the passwords in your system in various ways. First, you should severely limit access to the tables where the hash values of the passwords are stored. This applies to the USR02 and USH02 tables and in more recent releases the USRPWDHISTORY table. The best way to assign a separate table permission group to these tables is to do so, as described in Tip 55, "Maintain table permission groups". In addition, you should also control the accesses using the S_TABU_NAM authorization object.
After you have completed the development of the User-Exit, you still need to transport your validation. To do this, navigate back and highlight the validation you have created. You can now include the objects in a transport order using the Validation > Transport menu path. Finally, you need to activate your validation via the OB28 transaction. Please note that this is only possible for one validation (with several steps if necessary) per booking circle and time. Now your validation will be carried out with additional checks during the document booking via an interface.
Optimization of SAP licenses by analyzing the activities of your SAP users
You can adjust these evaluation methods in the table T77AW or in the transaction OOAW. To do this, select the respective evaluation path by selecting it, and click on the evaluation path (individual maintenance) in the menu on the left. The table that appears defines the relationships between the objects. For SAP CRM only the objects Organisational Unit (O), Headquarters (S), Central Person (CP) and User (US) play a role. For simplicity, you can now copy the lines that use the Person (P) object. Enter a new number here and replace the object P with the object CP.
How do I compare roles (RSUSR050)? With the report RSUSR050 you can compare users, roles or authorizations within an SAP system or across systems. To do this, start transaction SE38 and run the above report.
The possibility of assigning authorizations during the go-live can be additionally secured by using "Shortcut for SAP systems".
Add or change the permissions, the Maintenance Status changes to either Care or Changed.
There are extensive revision requirements for password rules.