topic Re: Password Fields in Application Development and Automation Discussions

Password Fields

Former Member — Thu, 13 Oct 2005 14:19:48 GMT

Hellos Guys:

This is the situation, a create a table where i'll store a user id and a password. It's there a way that the field PASSWORD be encrypted? i mean, if any see the table using SE16, SE11, SE16n, etc.. will see the actual password of the created accounts.

Thanks in advance,

Carlos Lerzundy

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:22:04 GMT

Yes you can use function modules to encrypt and decrpyt.

FIEB_PASSWORD_ENCRYPT

FIEB_PASSWORD_DECRYPT

If you encrypt the password and store it in the database, you will see the encrpyted password only.

Regards,

Rich Heilman

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:25:26 GMT

Here is a sample program.



report zrich_0002.


parameters: p_pass type FIEB_ENCRYPTED_PASSWD..

data: encrypted type FIEB_ENCRYPTED_PASSWD.
data: decrypted type FIEB_ENCRYPTED_PASSWD.

call function 'FIEB_PASSWORD_ENCRYPT'
     exporting
          im_decrypted_password = p_pass
     importing
          ex_encrypted_password = encrypted.


call function 'FIEB_PASSWORD_DECRYPT'
     exporting
          im_encrypted_password = encrypted
     importing
          ex_decrypted_password = decrypted.


write:/ p_pass.
write:/ encrypted.
write:/ decrypted.

Regards,

Rich Heilman

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:25:53 GMT

Thanks Rich!!!

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:29:13 GMT

Rich.. it seems that the FIEB_PASSWORD_DECRYPT is not working propertly, i mean, i execute your program (and test the FM in the SE37) but the encrypted data can't be decripted by that FM.

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:31:24 GMT

That's weird, the program works great in my system.

Regards,

Rich Heilman

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:32:56 GMT

What is the password that you are entering on the selection screen?

Regards,

Rich Heilman

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:35:22 GMT

"Carlos" (Without the qoutes)

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:35:23 GMT

Hi Carlos,

Testing the FM with SE37 doesn't always give back the results. Are you sure that Rich's program isnn't working.

Regards,

John.

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:37:35 GMT

Yes i'm sure.. i create a report using the Rich's Code. The results are:

Password: Carlos

Encrypted: } {zyxwvutsrqponmlkjihgfedcba`_^

Decrypted:

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:38:02 GMT

Carlos, my test program is working good in my system. Here is my output from my program using your name as the password.




Carlos                               
y~41qr:{Mt#(kHf5h*GqU6O-ay>xQj)"     
Carlos

Are you seeing something differnent?

Regards,

Rich Heilman

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:38:57 GMT

Ok, now i'm totally thrown. 😮

Regards,

Rich Heilman

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:41:16 GMT

Me too.. well thanks rich.. it would be the system? should i do somethin additional? Well, anyway you deserve the Problem Solved Points 😃

I continue trying to make it work.

Thanks John and Rich for your help.

Regards,

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:50:27 GMT

Well, do you think that you really have to be able to decrypt it? Here is what I mean, the passwords only function would be to check that the user is allow to access something else, so if you are storing the encrypted password, do you have to check it against the decrypted version in order to check the validation.

I know, i'm confusing you.

In your program, you are throwing a screen where the user must enter a password, the are entering it as plain text, example "Carlos" when you are processing the check, encrypt it using the function module, then check the encrypted value against the encrypted value which you previously stored in the database. In my system it is always in encrypted it the same way, so you could just check the encrypted version, right? No need to ever decrypt. This way is better for security reasons anyway.

Regards,

Rich Heilman

Re: Password Fields

Former Member — Thu, 13 Oct 2005 14:57:14 GMT

You're so right! I can check the encrypted version.. i don't need to decrypted in order to compare...

Thank you so much!!

Regards from Venezuela

Carlos 😃

Re: Password Fields

RichHeilman — Thu, 13 Oct 2005 14:58:25 GMT

Cool, please make sure to award points for helpful answers. Thanks.

Regards,

Rich Heilman