System does not let you log on using a password

In case user is getting a below message on attempt to logon to SAP NetWeaver/ABAP Platform based system:

This system does not let you log on using a password

Message no 00139

 

It means that password based logon to particular system was disabled. In such a case user has to use different authentication method to logon. There are following:

• Using password (conventional logon) – method that is not possible in this case

• Using an external security product (SNC)

• Using an X.509 browser certificate (intranet/Internet)

• Using a Workplace Single Sign-On (SSO) ticket

 

In case majority of the users in respective SAP system are using a different type of the authentication than password then it should be disabled. The disabling can be done system profile parameter called login/disable_password_logon.

The parameter’s default value is 0 that means the password-based logon is possible. Other allowed values are:

1 - Password logon only for users of the group specified by login/password_logon_usergroup

2 - Password logon is no longer possible in general

More information:

Profile Parameters for Logon and Password (Login Parameters)

320991 - Error codes during logon (list)

Evaluating user password in NetWeaver ABAP systems

ABAP programmers sometime need to authenticate a user during the runtime of some ABAP application. As an example of this need; one can say that if user is supposed to confirm some data in ABAP application a system shall ask for user’s password and once it is correct it really does the confirmation. Assumption here is that once user is entering the password he or she must be really aware that a particular activity (e.g. confirming a batch in manufacturing process) is untended to be done.

So being as the ABAP programmer how would I validate the user password? Luckily SAP is providing a very handy function module to do that. The name of the FM is SUSR_LOGIN_CHECK_RFC. It has very simple interface of importing parameters and by evaluating exceptions I can suite my application with regards either validation passed, user is locked, password is wrong etc.

REPORT ZMM_PWD_CHECK.

PARAMETERS: p_usr TYPE sy-uname,
            p_pwd TYPE rsyst-bcode.

CALL FUNCTION 'SUSR_LOGIN_CHECK_RFC'
 EXPORTING
   bname                  = sy-uname
   password               = p_pwd
 EXCEPTIONS
   wait                   = 1
   user_locked            = 2
   user_not_active        = 3
   password_expired       = 4
   wrong_password         = 5
   no_check_for_this_user = 6
   internal_error         = 7.

WRITE: sy-subrc.
CASE sy-subrc.
  WHEN 0. WRITE: 'everything OK'.
  WHEN 1. WRITE: 'wait'.
  WHEN 2. WRITE: 'user_locked '.
  WHEN 3. WRITE: 'user_not_active'.
  WHEN 4. WRITE: 'password_expired'.
  WHEN 5. WRITE: 'wrong_password '.
  WHEN 6. WRITE: 'no_check_for_this_user'.
  WHEN 7. WRITE: 'internal_error'.
  WHEN OTHERS.
ENDCASE.

Source code available at: github.com/softy12/ABAP-PWD-CHECK