Avoiding rdisp/gui_auto_logout timeouts for selected users

[martin_E]

Hi Martin,
as long as I know, the parameter rdisp/gui_auto_logout is Instance related and affects to all the users connected to the instance. Please confirm that there is not possible to exclude just one user from this setting.

They're right. Having said this, there is a way around this for selected users, but you do need to bear in mind the purpose of the rdisp/gui_auto_logout parameter;

• Not only does it prevent the user from holding resources (because an unused session still takes up a small amount of storage and other resources), it is designed for the protection of the user themselves.


• If the user's session remains logged in, then when / if they walk away, the session and their logon is available for anyone else. Anything thing done in this session by a "walk by" will be recorded under the original user's login.


• Also, if we prevent the user from being logged out by a timeout, they will need to ensure they perform their own logoff at the end of their work day.


• From a security perspective, you MUST have rules and processes in place to ensure that the next operator uses their own login and does not simply "swap seats" and continue using the original operator's user.


• This means that if you enable this functionality, then you need to make sure it is secured and can only be executed by a select few people.

Because of the security implications, note the built in Authorization Check. If you don't understand the need for the AUTHORITY-CHECK, do not implement the program.

• Add the Authorization Object via transaction SE21,


• Add the Authorization Object to appropriate roles in transaction PFCG; Either
  
  
  
  • Select one or more roles used by the users requiring this functionality,
    Add the required user to the Authorization Object for that role.
  
  
  • or create a new role containing this object and add it to the appropriate users.
  
  
  
  

REPORT Z_TIMEOUT.



PARAMETERS: P_SLEEP type i default 300.



AUTHORITY-CHECK OBJECT 'Z_TIMEOUT'

    ID 'USER' FIELD SY-UNAME.



IF SY-SUBRC NE 0.

  MESSAGE 'Unauthorized User' TYPE 'E'.

  EXIT.

ENDIF.



WHILE 1 = 1.

  WAIT UP TO p_sleep SECONDS.

  CALL FUNCTION 'SAPGUI_PROGRESS_INDICATOR'

    EXPORTING

      percentage = 0

      text       = 'Keep alive'.

ENDWHILE.

Logon and open a new mode.
Run this program in one SAP GUI mode.

If the user passes the AUTHORITY-CHECK, the Function Module SAPGUI_PROGRESS_INDICATOR will write to the SAP GUI Status line, and keeps the SAP GUI session alive (including any other modes), so long as the value entered in P_SLEEP is less than the rdisp/gui_auto_logout value.

hth

[hardyp180]

We have some quarries where the truck driver comes in during the middle of the night and reaches through a window to input something into SAP (they just press a button on a screen and it prints a ticket for them). The hut is unstaffed and the SAP session runs all through the night. You would expect that not to work, it could be two hours (or more) between drivers arriving, and the session would be auto logged out.

So many years ago, back in 2000 I think, our BASUS people had us set up one fake user for each such quarry with "NIGHT" at the start of the user name, and excluded those users from being logged out automatically.

How? You will ask. I have no idea. it was 20 years ago, those who did it are all gone, and I did not understand what they had done even back then. But it works to this day ... some users are exempt from auto logout.... I just checked in AL08 and all those "night" users are on different servers, the same servers as the real users so its all black magic.

 

 

[martin_E]

Hi Paul,

You'll have to imagine the witty comment I had here, before the comment function died on me ... It was really good, and you would have appreciated it. In fact it was so funny, you should send me a beer

Anyway, is the application you describe running on a SAP GUI ?  I do remember some thing vaguely similar from last century, but it was using SAP Console I thing (similar to what is described in the first part of this) not the SAP GUI.

It worked in a similar way, staying logged in by polling the SAP system often enough to keep the session alive.

Martin

[hardyp180]

Yes it's in the SAP GUI.....

[martinc_mb]

Hello Martin,

This is a nifty solution to the problem, but of course it has the drawback that it uses up a session and I'm the kind of person who is always maxing out all 6 sessions, all of the time.

I wish SAP would introduce an option to extend the 6-session limit but, even then, one would have to convince the Basis personell why this is necessary.

While I'm ranting, you know what feature I really miss? The ability to reconnect to a logon when you were thrown off and your logon is still active on the system. That is such a useful feature; I wonder why they ever removed it. (Completely unrelated, but I was just thinking about it now).

Keep well!

Martin

[martin_E]

Hi Martin,

Apologies for the delay in replying; I've retired and don't follow up here much any more. Bear in mind that you do have the ability to extend the number of sessions per user, and to be fair, if you can make a business case for it then your BASIS administrators should followup for you.

1. Ask your BASIS people to investigate changing the rdisp/max_alt_modes parameter via transaction RZ10. This can be changed for the entire system or for just one ABAP instance.
2. The other trick is to see if they will enable multiple logons for your specific user, by use of the combination of parameters login/disable_multi_gui_login and login/multi_login_users - See Multiple Logon on the help page  https://help.sap.com/docs/SAP_NETWEAVER_700/129affcf6c531014b28cae6d2a9cf86f/4ac3f18f8c352470e100000...
   This would allow (in your case) 6 sessions per login

Good luck

[martinc_mb]

Hello Steve,

Thanks for your reply!

I see that rdisp/max_alt_modes can be set up to 16. That is news to me. I have been laboring under the misconception that the maximum is 6 (which it used to be). Shows you how long ago I checked that! Thank you for enlightening me.

Does the ability to have multiple logons also enable you to reconnect to existing logons from which you were disconnected? Maybe there is also something I am not aware of, e.g. that this feature is controlled by some parameter? (I just took a quick look through the page you linked and there I don't see anything that looks like it there).

(I have not been at a client for years though, that allows multiple logins; normally there is a message during logon that tells you that this violates the SAP licensing agreement, or something to that effect).

Kind Regards,

Martin