Creating a SAP password

[Former Member]

Hi,

does a BAPI exists, that creates me the hash-value out of an entered plaintext password?

Am I am right, that the plaintext password for SAP-users is stored in table USR02 as a hash-value (field passcode)?

So my requirement is similar the requirement for user authentification, I want to create store the entered password in an transparent table and nobody should be able to recreate the plaintext out of the hash-value.

Many thanks for your help,

Christoph

[Former Member]

Hi,

does a BAPI exists, that creates me the hash-value out of an entered plaintext password?

Am I am right, that the plaintext password for SAP-users is stored in table USR02 as a hash-value (field passcode)?

So my requirement is similar the requirement for user authentification, I want to create store the entered password in an transparent table and nobody should be able to recreate the plaintext out of the hash-value.

Many thanks for your help,

Christoph

[nabheetscn]

Hello,

Baisclly SAP uses Kernel level system call to achieve the same functionality.You can do the same but in different way.Wat you can do is create one function module to creat password and one to read the password.

Inside this function module you can write your algorithm that if user set A as password it should be stored as B or C whatever.In that case the password will remain hidden.

Just write a piece code snippet as the way you want your password to be.

Hope it helps.

Regards,

NAbheet

[Former Member]

Hi,

thanks for your fast reply. So am I right that I can not use SAP basis functionality - like a FM where I can enter a password and get the hashvalue out of it? I really need to write my own code for this issue?

Thanks a lot for your help,

Christoph

[nabheetscn]

Hello,

Yes i tried the same to check how does SAP does it.While debugging i found out it uses SAP sytem calls to generate and store password.

Basically kernel level calls are der.

It will be good if you create your algorithm and logic for the same.You will have much more flexibily and control.

May be we can discuss it further how the design will look like if you want..

Regards,

Nabheet Madan

[Former Member]

Try,

Fm IDWT_CIS_PASSWORD_HASH

[nabheetscn]

Hello,

Does this FM exist..?I am not able to find it...

Regards,

Nabheet

[Former Member]

I am using ECC5.0. Its there.

ELSE TRY Fm CALCULATE_HASH_FOR_CHAR

Regards,

Ravi

[nabheetscn]

Hi Ravi,

We have the second one in ECC6.0.Lets say we used this FM.This FM just gives the Hash value right...?How will decrypt the password if we want to..?

Regards,

Nabheet Madan

[Former Member]

In se37 search HASH . you will get lot of function modules.

Regards,

Ravi

[Former Member]

Hi,

If we decrypt the password , then there is no logic for encrypting passwords.

Always get the user input from screen(plain text) and encrypt this text into hash.

then compare this value with the already saved value.

Regards,

Ravi.

[Former Member]

Did you got solution? what is your requirement?

Ravi.

[Former Member]

Hi,

thanks for these answers. The only requierement is, that I want to store a password as Hash-Value and

compare it with a password the user is entering. So your solutions should work fine, the only thing is that nobody should be able to get the plaintext password out of the hash-value - but I think this is not possible, am I right in this case?

Many thanks for your answers,

Christoph

[nabheetscn]

Correct,

Thanks Ravi...

[Former Member]

Hang on a moment here... this will only fool an enduser, and not all of them either...

You should consider that anyone who can display your algorithm in the function can work out how to reverse the hash.

Also, even if you hide it, someone who can obtain the hashes can call your function from their own program and try to reproduce it using a dictionary attack (sooner or later it will match some cleartext string).

This is why SAP´s function is in the kernel, has a protected call stack (only to be called from known programs) and the hashes now have client specific attributes to them (code version F) and salted-hashes (code version H).

Cheers,

Julius