Password encryption in SAP

[nishanthbhandar]

Hi all,

I have a requirement where i need to store the user's password.Please provide suggestions as to how i can provide security so that this password should not be hacked.Please see the below :

-- I can store the encrypted form of the password in the database table.Thus looking at the database table will not allow you to find the password.

-- The problem is that hackers can look into the code and find the logic used for encrypting the password and decrypt it.

I need to find a safe and secure way of not allowing the password to be hacked.Please let me know what i should do to achieve this.

Thanks

Nishanth

[nishanthbhandar]

Hi all,

I have a requirement where i need to store the user's password.Please provide suggestions as to how i can provide security so that this password should not be hacked.Please see the below :

-- I can store the encrypted form of the password in the database table.Thus looking at the database table will not allow you to find the password.

-- The problem is that hackers can look into the code and find the logic used for encrypting the password and decrypt it.

I need to find a safe and secure way of not allowing the password to be hacked.Please let me know what i should do to achieve this.

Thanks

Nishanth

[Lakshmant1]

Hi Nishanth,

Try this,

Use Decode and Encode functionlity to the source code of the program in which the encrypt and decrypt logic is written .Ensure that the Decode functionlity should not allow the view of the source code.

Thanks

Lakshman

[former_member182371]

Hi,

please do have a look at the following FM´s:

1.- FIEB_PASSWORD_ENCRYPT

2.- FIEB_PASSWORD_DECRYPT

Best regards.

[Former Member]

hi,

take a look at TX: su05 it stores a password to corresponding internet user ID and password. here the password is stored in encrypted form.

here you can store a password for an ID of object type in type field. by doing f4 you will get the different obj types available.

the tables effected are: BFUSER_TYP : Valid object types for Internet users

BAPIUSW01 : User ID Table for Internet Appplication Components

so you can set a password here and check verify it.

for checking and setting password there are BAPIS available.

we have done this way for object type employee.

where we have used ID as emp no.

regards.