Note 25591 - Changing the DBM, SYSDBA and DBA User Passwords

22.05.2008 Page 1 of 5

Note 25591 - Changing the DBM, SYSDBA and DBA user passwords

Note Language: English Version: 40 Validity: Valid from 03.05.2006

Summary

SymptomYou want to change the database user passwords.

More TermsDBMGUI, DBMCLI, SQLSTUDIO, control, password, password change, user,dbmuser, dbmpwd, superdba, sapr3, sapsid, sapsiddb

Cause and PrerequisitesThe latest versions of DBMGUI and SQLStudio (7.6) are required whereverthese are mentioned. Install the DBMGUI from Version 7.6 to change thepasswords using the procedure described in this note.

You can also use the tools belonging to the MaxDB Version 7.6 to managedatabases with MaxDB kernel < 7.6.

SolutionThere are several basic types of database users. These users are describedin detail in the documentation (Note 767598).

1. Brief description of the user types:

a) DBM userA DBM user can manage the database 'externally'. This 'primary' useris specified in the 'db_create'.

dbmcli -R db_create TST control,control

This 'primary' DBM user- can create other DB users- is managed at operating system level- is used for start, stop, backup, recovery, db_drop, and so on.- uses the DBMGUI for work on the database

The default DBM user in the SAP environment is called 'control'.

b) SYSDBA userThe SYSDBA is the user with the most privileges in the database. Thisuser is specified when the database is activated.

util_activate superdba,admin (SAP DB Versions 7.3/7.4)db_activate superdba,admin (MaxDB Versions >= 7.5)

The SYSDBA user- only appears once in the database- is managed within the database- is used for all types of SQL commands- generates other SQL users- is an SQL user that uses SQLStudio for working on the database.

The default SYSDBA user in the SAP environment is called 'superdba'.

22.05.2008 Page 2 of 5


c) DBA user

The DBA user is a simple user within the database. This user iscreated using SQL tools before the database contents are loaded.

create user sapr3 password sap dba not exclusive ...

A DBA user- can be created as many times as you like- is managed within the database- is used for SQL commands that the user can execute as part of itsDBA authorizations- owns the tables for the particular application in use- can log onto the SQLStudio

A default DBA user in the SAP environment issapr3, sap (depending on the R/3 Version)sapdb (in the Java environment)

d) Domain and Sysinfo user

Domain and Sysinfo users are special users that are only used forinternal administration. These users cannot access application data.There is no need to change these passwords.

Note:To simplify logon procedures, SYSDBA users are also available on DBMuser level and the 'primary' DBM user is also in the database.

2. Changing the DBM user password

The database must be 'offline'.

You can either change the password for the DBM user with the DBMGUI ordirectly at operating system level with DBMCLI.

2.1 Change with DBMGUI

Call the DBMGUI and log onto the database where you want to change theDBM password.Configuration -> DBM Operator -> Select the DBM user, for example'control' using 'Properties' and enter the new password twice using'Change'.

2.2 Change with dbmcli

Log onto the relevant database as a DBM user with DBMCLI.

Change the password with the user_put command as follows: user_put password=For example: dbmcli -d C11 -u control,control user_put controlpassword=new

Note: If you have saved default logon data in the DBMGUI, make surethat these are also updated.Procedure: To validate the new password on your Windows PC within the

22.05.2008 Page 3 of 5


DBMGUI, log onto the database by double-clicking again on the relevanticon, but this time with the new password for the DBM user. (Confirmthe error message '-2 ERR_USRFAIL: User authorization failed' to goautomatically to the logon menu. You must then save the new passwordwith 'Store User Name and Passwort' for the implicit logon.You must carry out this adjustment on all Windows PCs that allowed youto access the database via the DBMGUI in the past and should allow youto do so in the future.

The password changes are immediately active.

3. Changing the password for the SYSDBA user

The database must be 'online' or 'warm'.You can either change the password for the SYSDBA user with SQLStudio,DBMGUI or with DBMCLI.

3.1 Change with SQL Studio (only database core versions < 7.6)

Log onto the relevant database on SQLStudio with the SYSDBA user (forexample, 'superdba').

Execute the following SQL statement: alter password to

After this statement, you must load the system tables so that the newSYSDBA password is also maintained at DBM level (file: *.upc).

a) Loading the system tables with DBMCLI:When loading the system tables with the DBMCLI, you must already enterthe new SYSDBA password.

b) Loading the system tables with DBMGUI: the system tables are loadedusingConfiguration -> Upgrade Systemtables

Note the following:When loading the system tables, you will see the error message-24909 SYSDBA unknown [load_systab....]Once you confirm this error message, you must specify the logon datafor the SYSDBA (for example, 'superdba') with the new password and thedomain password.


Call the DBMGUI and select the database for which you want to changethe SYSDBA user password.

Enter Configuration -> Database User -> SYSDBA user (for example,'superdba') with the existing password. Then highlight the SYSDBA (forexample 'superdba') and select Properties. Using 'Change', enter thenew password twice. The password is thus automatically updated in the*.upc file. There is no need to load the system tables.

3.3 Change with dbmcli

Log on as a DBM user with DBMCLI to the database:for example,dbmcli -d C11 -u control,control

22.05.2008 Page 4 of 5


Change the password with the user_put command as follows: user_put password=for example, user_put SYSDBA password=newThe password is automatically maintained in the *.upc file in thiscase also. There is no need to load the system tables.

4. Changing the password for DBA users

The database must be 'online' or 'warm'.You can change the password of a DBA user with SQLStudio or withDBMGUI.

4.1 Change with SQL-Studio

a) The password for a DBA user is changed by SYSDBA:

Log onto the database as user SYSDBA in the SQLStudio.

Execute the following SQL command: alter password

b) The DBA user password is changed by DBA itself.

Log onto the database as the DBA user in question (for example, SAPR3)using SQLStudio.

Execute the following SQL statement:alter password to


Call the DBMGUI and select the database where you want to change a DBAuser password.

If you are changing the password using the DBMGUI, make sure that theuser whose password you are changing is not logged onto the database.Otherwise, the following error message will appear when you change thepassword: -24988 sql error [sql_execute ALTER USER ...DBA TIMEOUT NULL ... -7048 Drop User not allowed while user is connected

The password is changed as follows:Configuration -> Database User -> Log on as user SYSDBA and highlightthe DBA user whose password you want to change. Using 'Properties' and'Change', enter the new password twice.

5. Updating the connection data for the different applications

You must also save the new passwords directly in SAP products,depending on the particular SAP product used.

a) Precomp. applications (R/3, WebAS, SCM, all applications that runwith disp + work)In this case, the Xuser data must be updated on all instance serversas described in Note 39439.

b) Java applications manage the connection information for thedatabase in the Secure Store.

22.05.2008 Page 5 of 5


c) SCM connection to the liveCacheThe connection data are maintained using transaction LC10.In this case, a special command must also be executed for the DBAuser. To do this, log onto a command line with dbmcli on theliveCache:dbmcli -d LCA -u control,control> user_sap ,> exit

d) Secondary database connections using transaction DB59.The new user data must also be maintained in this case.

Header DataRelease Status: Released for CustomerReleased on: 03.05.2006 07:19:34Priority: Recommendations/additional infoCategory: Consulting

Main Component BC-DB-SDB MaxDBAdditional Components:

BC-DB-LVC liveCache

The note is not release-dependent.

Related Notes

Number Short Text700659 Security Guide: mySAP Supply Chain Management607082 No connect after 'Disabled' indicator activated for DBM user386714 SQL studio + Database Manager GUI installation39439 XUSER entries for SAP DB 6.x and 7.x

Attributes

Attribute ValueDatabase system ADABAS D

Note 25591 - Changing the DBM, SYSDBA and DBA User Passwords

Documents

Transcript of Note 25591 - Changing the DBM, SYSDBA and DBA User Passwords