topic Re: Password-hash calculation in Application Development and Automation Discussions

Password-hash calculation

Former Member — Tue, 26 Aug 2014 13:55:43 GMT

hi!

passwords of our internet users are stored in BAPIUSW01-PASSWORD as a password hash. The hash is calculated by the system-call XXPASSNET.

After we changed the password ruleset (kernel parameters login/min_password_digits and so on), hashes generated previously are no valid passwords anymore. The call returns an empty hexpass. In other words: no user can login anymore.

Is there a way to calculate a hash from a given string (=password) in the same way as XXPASSNET does? I already tried FM MD5_CALCULATE_HASH_FOR_CHAR or CALCULATE_HASH_FOR_CHAR, but they do not return the same result. Looks like XXNETPASS does not use MD5 or SHA1 but something else?

We authenticate using BAPI_PAR_EMPLOYEE_CHECKPASSWOR, which calls FM WWW_USER_AUTHORITY - inside, there is XXNETPASS called.

Thanks for all information

Roland

Re: Password-hash calculation

Former Member — Tue, 26 Aug 2014 15:07:36 GMT

It's probably the value of login/password_downwards_compatibility that has caused the problem. Pinging the space so that others can pitch in. Meanwhile you may want to read .

Re: Password-hash calculation

SuhaSaha — Tue, 26 Aug 2014 15:36:35 GMT

If wants we can move the thread to the Security section.

Re: Password-hash calculation

Former Member — Wed, 27 Aug 2014 07:31:07 GMT

hi,

login/password_downwards_compatibility is set on (which is the default value) in our systems. As far as I understand, this parameter allows other (older) hashes to be used and does not affect password rules such as at least one upper-case char, one special char etc.

Thanks for the link to the blog, very interesting. XXPASSNET uses codeversion A when called from the above mentioned BAPI.

Roland

PS: if the security section is the right choice for this topic, please move.

Re: Password-hash calculation

Former Member — Wed, 27 Aug 2014 17:59:31 GMT

Last I heard, the SU05 internet users were deprecated and no longer supported.

Take a look at FM susr_internet_user_migration, which converts them to SU01 users and issues them a proper code versioned password hash which is compatible and not reversable.

Cheers,

Julius

Re: Password-hash calculation

Former Member — Thu, 11 Sep 2014 08:22:42 GMT

Thanks Julius. More-or-less I got the same reply from SAP support - it is simply not supported anymore. I cannot convert to SU01 users, so we are going to replace the password creation bapi by an own development and have all users to create new passwords.

Re: Password-hash calculation

Former Member — Thu, 11 Sep 2014 08:42:45 GMT

I added the password-creation class in the SCN wiki. ABAP class to create random chars or passwords - Code Gallery - SCN Wiki

Re: Password-hash calculation

mvoros — Thu, 11 Sep 2014 09:51:08 GMT

Hi,

I would suggest to use standard FM RSEC_GENERATE_PASSWORD that is used by SU01 when you ask system for an initial random password. The generated password will comply with system password policy.

Cheers