Known Users are Delivered Disabled

The system is delivered with one or more known users. Oracle Utilities Application Framework provides SYSUSER. Other product layers provide additional users for various reasons. Some of these users are provided to serve as template users with configuration to apply to new users during provisioning. Other users are provided for internal, technical reasons. Users with a login ID that has the prefix "SYS" are treated specially. These users can be used for internal processing, but there is logic to prevent anyone from signing in to the application with one of these users.

Previously there was no logic to prevent users and internal processes from logging in as SYSUSER or as a user provided by other product layers to serve as template users.

In this release, SYSUSER and the template users are delivered as disabled. Now any user or system process that attempts to access the system with one of these users will receive an error. Note that this update is not part of the initial release of 25.4 but will be delivered as part of an early maintenance pack.

You should identify any process that uses SYSUSER or one of the other product delivered template users, and use a different user defined by your implementation instead.

Preventing users and processes from accessing the system using a known user ensures better security and auditing. All users should access the system with an appropriate user ID defined by your implementation.

Steps to Enable

You don't need to do anything to enable this feature.

Tips And Considerations

If it is not possible to adjust processes that use SYSUSER or one of the other users delivered as disabled for this release, a security administrator is able to re-enable any of the system-provided users that are disabled for only this release. To do so:

  1. Navigate to the User page and select the user that you wish to enable.
  2. Update the Enable/Disable flag to Enabled.

In the following release, users will be delivered as disabled again and the capability to re-enable will no longer be allowed.