SAP users at Lakeland Dairies who encounter lockouts often find themselves in a situation where they must engage with the IT service desk, initiating a cumbersome process of raising requests to the SAP Security or Basis teams. These requests to unlock and reactivate their accounts are essential to resume their tasks. However, this manual intervention, while necessary, inadvertently ushers in a series of challenges that impact both time and operational efficiencies.
Lakeland Dairies runs 24/7 and at any time a user can lock themselves out of SAP, often while the product is sitting on a pallet to be put on the back of a truck. If the SAP user is locked, this means the product cannot be scanned and therefore cannot leave the warehouse.
In this scenario, the time-sensitive nature of business processes can suffer significant setbacks as users await the resolution of their locked accounts. The need to route requests through multiple channels and teams introduces layers of complexity, extending the downtime experienced by users and affecting the overall productivity of the organization. Moreover, the verification and management of the reactivation process pose additional hurdles for administrators, diverting their attention from more valuable tasks that could contribute to the company’s growth and innovation.
To address this challenge, Lakeland Dairies leveraged the automation solution of IT-Conductor to streamline the process of unlocking SAP user accounts and resetting their passwords. By automating the reactivation process for locked accounts caused by incorrect login attempts, along with password resets, the automation solution ensures prompt resolution, eliminating the need for manual intervention and empowering users to regain access without undue delays.
Given that IT-Conductor is already covering the APM monitoring of the customer's S/4HANA landscape, the integration of this automation solution offers a more streamlined approach. This integration not only aligns seamlessly with the existing monitoring framework but also magnifies the benefits derived from it. By incorporating the user unlock and password reset automation, the entire account management process becomes more cohesive and efficient.
Figure 1: Recovery Actions by Application
The user unlock and password reset automation solution is designed to cater to the needs of both Dialog and Service users whose accounts have been locked due to incorrect login attempts. It was implemented in both the S/4HANA front-end and back-end systems, addressing the challenge of locked accounts with a unified strategy.
Technology Stack Used: IT-Conductor Process Definition, Process Composer, thresholds, monitors, retrievers, etc.
SAP Integration: SAP RFC, function modules, etc.
To facilitate the implementation of this automation solution, the following criteria were fulfilled:
Configuration of SAP systems in IT-Conductor for monitoring
Creation of e-mail addresses in users' master record
Creation of SAP back-end admin user with user administration privileges
Creation of Robot User account in IT-Conductor
The deployment process starts with getting the user details and checking them against the specified criteria for different user types. Following the initial verification, the workflow continues to check the user expiration date, set the user password, unlock the user account, and finally notify the user of the results.
Figure 2: User Unlock and Password Reset Process Definition
Get User Details: This activity gets the username, email address, user’s expiration date, user type, user group, and lock reason, which could be any of the following: locked due to incorrect login attempts, locked locally by the administrator, locked globally by the administrator, or locked on “No password”.
Check Type: This activity is an “If” condition that checks the user type obtained from the Get User Details step against the specified criteria for user types – A and S.
Check Lock: This activity checks the user lock status whether it was locked due to incorrect login attempts, locked locally by the Administrator, or locked globally by the administrator. The outcome of this check will determine the path of subsequent steps.
Check Expiration: This activity checks the user expiration date.
Set User Password: This activity resets the user password by creating an initial password that comprises all the characters in the password policy.
Unlock User: This activity involves unlocking the user.
Notify User/Admin on Unlocked: This activity notifies the user of the initial password upon successful unlock.
Notify User/Admin on Error: This activity notifies the user of an unexpected error.
Notify User/Admin on Expired: This activity notifies the user if the account can't be unlocked due to password expiration/expired validity date.
Notify User/Admin on Locked: This activity notifies the user in cases where the account cannot be unlocked due to it being in an expired state or having been manually locked by the administrator.
