Salt does not protect against brute force attacks because the salt is usually stored adjacent to the hash in clear text so it doesn't add additional (unknown) entropy. Salt is a mitigation against rainbow table attacks.
Protection against brute force is provided by the hashing algorithm itself. The hash algorithm should be slow so that a brute force attack will take an infeasible amount of time.
In addition, cryptgraphic "pepper" added to the cleartext + salt can make the brute force attack more difficult because it renders a dictionary attack impossible. On the other hand, if the hacker has access to the DB table with the hashes and the salts, he may also have access to the pepper.
If the SAP system uses pepper, the length of the password doesn't matter, because the pepper will be longer than the password anyway. If it doesn't, then shorter passwords are indeed more vulnerable as the brute force attack will check for shorter passwords first.
More info on salt vs. pepper here and here.