Password Encode MD5

Sze Chun Tan
Sze Chun Tan
in AppWorks #1

Hi,

 

is there any possible way to disable the encodeMD5 during the Metastorm V9 login?

 

Thanks

Tagged:

Comments

  • Tony Wheeler
    Tony Wheeler
    #2

    That MD5 hash is there to protect your users. Do you need a cleartext password in the SAP script for a custom authentication scheme?

  • Sze Chun Tan
    Sze Chun Tan
    #3

    Yes, I do. It was needed to authenticate the AD user.

     

    mind to share with me, twheeler?

     

    Thanks

  • Tony Wheeler
    Tony Wheeler
    #4

    Hi Chun,

     

    We have ticket open with Development regarding this. The issue is that v7.6 allowed you to modify the DOM of the login page so you could add your own custom fields (such as a clear text password). Those fields would then be available in the SAP script by querying the DOM under ework.FieldInputList[].

     

    v9.x seemingly does not expose the FieldInputList[] to you in the same way so your SAP script only has access to the username and password fields. The password field is hashed by default which makes LDAP authentication impossible (since it requires a cleartext password).

     

    ** This post has been edited because the workaround previously described results in unintended behavior **

     

    The defect has been identified and will be corrected in a future release. The option to send the unhashed password from login page to SAP script will be provided.

  • Sze Chun Tan
    Sze Chun Tan
    #5

    Thanks.

     

    while my solution is call the LDAP authentication in Login.aspx.cs before ValidateUser.

    below is the LDAP authentication function

     

    private bool Authenticate(string userName,string password,string domain)
    {
    bool authentic = false;
    try
    {
    DirectoryEntry entry = new DirectoryEntry("LDAP://" + domain,
    userName, password);
    object nativeObject = entry.NativeObject;
    authentic = true;
    }
    catch (DirectoryServicesCOMException) { }

    return authentic;
    }

  • Secretariat Sdi
    Secretariat Sdi
    #6

    Hi,

     

    Has anyone the right syntax using ework.LDAPSearch function for SAP authentication to ActiveDirectory ?

     

    thanks, regards

     

    Juan

     

  • Chris Schroeder
    Chris Schroeder
    #7

    Has this been fixed as of yet?

     

    CHRIS

  • Neil_Hudspeth
    Neil_Hudspeth
    #8

    Looks like this is addressed in 9.1.3.  This is taken from the 9.1.3 release notes:

     

    "A new entry can been added to the Web Client's web.config, Administrative Tools web.config, and Deployment’s deploymentService.exe.config that determines whether the component encodes the user's password before it is sent to the BPM Engine via the ECL. This can be of use to developers creating custom SAPs that are reliant on receiving the credentials in plain text. "

Categories

image
OpenText CE Products
AppWorks
Gateway & Platform