Many users of your SAP-enabled web applications will be people who do
not have named SAP userids, either because they are employees who do not
require constant access to SAP or because they are business partners. So your applications will use a generic userid (or several, for different types of applications). In many applications, though, you require a
userid/password mechanism that guarantees that only authorized persons can access the functionality.
While you could implement the required mechanism yourself (outside of
SAP), it is probably faster and easier to use the password BAPIs that SAP
provides for the object types Employee, Customer, Vendor, Applicant, and
BusPartnerEmployee. (There are some additional object types with password
BAPIs but they are either obsolete or have incomplete password
functionality.) These object types have a set of BAPIs that allow you to
create object type-specific userids and passwords and manipulate and check them.
In SAPGUI, you can use transaction code SU05 to maintain these userids. A normal application will at least need to check the password that a user enters and may also let the user change the password. A more sophisticated
application might even enforce a periodic password change.
An administrator application (as an easy-to-use alternative to SU05) must be able to create, delete, and lock userids, re-initialize the password (in case the user has forgotten it), and check the status of a userid. The SAP password BAPIs allow you to do all these things, without you having to worry about a separate database, password encryption et cetera.
If you want to save some time in getting up to speed with these BAPIs, read my article "Password Management for Extranet Applications" in the
July/August issue of the SAP Professional Journal (www.sappro.com). And if
you are using the SAP Java Connector (JCo) for your applications (the best
BAPI middleware I am aware of) then you can even save more time: I have developed a Java component that encapsulates access to the password BAPIs
and allows you to manipulate the userids and passwords with a few lines of
code. Contact me (tgs@arasoft.de) if you want to receive an evaluation copy.
By the way, if you are already on 4.6C or later, there is a new mechanism for dealing with external users. RFM SUSR_USER_INTERNET_CREATE allows you to create new standard users through RFC. Details about how to deal with the associated license issues can be found in OSS Note 313585.
Thomas G. Schuessler, www.arasoft.de
