<html>
<head>
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<div class="moz-cite-prefix">Hi,<br>
<br>
That's right. We store all passwords in encrypted form. However
the key is NOT stored in the database. The key is in the keystore
(which can be switched to HMS if necessary). So the password
exposure is somehow limited.<br>
<br>
We need cleartext password to be able create new accounts. And we
need permanent access to the cleartext because accounts may be
created for a user any time (e.g. new role is requested and
approved). As far as I know there are only three more-or-less
practical ways how to solve this:<br>
<br>
1: cleartext (or reversible encrypted) password storage. This is
what we do now. Very convenient and very practical. But there is
security risk.<br>
<br>
2: Do not store passwords at all. When a new account is created
notify user that there is a new account and it needs to be
activated by setting a password. Then the user authenticates by
his existing credentials (e.g. AD or LDAP) and sets the password
for that new account. Forget the password right after it is set.
This is more secure but not very user-friendly approach.<br>
<br>
3: Store passwords hashed by all the hashing algorithms that all
the connected resources need, regardless whether the user has an
account or not. The use the hashed value when setting up new
account, not a cleartext. This is theoretical option. It may be
feasible for some resources. But it will not work for all cases
because too many application interfaces require a cleartext
password when creating new account. A variation is to always
create accounts on all the resources for everybody, just disable
the accounts. However, the question here is how to connect a new
resource. That would require to force change of all the passwords
for all the users.<br>
<br>
The options two and three have also additional drawbacks. E.g.
they cannot be used to implement a policy which requires to use
different passwords for different applications (e.g. different
security levels). In that case theoretically midPoint can check
that the password are different, but it cannot check if the
difference is just one letter or there is fact substantial
difference. So, all the options have advantages and disadvantages.<br>
<br>
Currently we support only option 1. This seems to be the common
trade-off and the most popular method in IDM field. So we have
started with that. I would love to implement option 2 as soon as
possible if we can secure a funding for that. Option 3 may be also
interesting, but I'm not sure how practical it can be.<br>
<br>
<pre class="moz-signature" cols="72">--
Radovan Semancik
Software Architect
evolveum.com
</pre>
<br>
<br>
On 04/01/2016 07:53 PM, Camilo Viecco1 wrote:<br>
</div>
<blockquote cite="mid:D323F699.4077%25camilo_viecco1@symantec.com"
type="cite">
<div>So why not use a temporary mechanism push the cleartext
password between components (memory/pipe/TLS channel). Keeping
the ALL passwords in cleartext is an unnecessary risk, any plans
to move away from this?</div>
<div><br>
</div>
<div>Camilo</div>
<div><br>
</div>
<span id="OLK_SRC_BODY_SECTION">
<div style="font-family:Calibri; font-size:11pt;
text-align:left; color:black; BORDER-BOTTOM: medium none;
BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT:
0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid;
BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span
style="font-weight:bold">From: </span> midPoint <<a
moz-do-not-send="true"
href="mailto:midpoint-bounces@lists.evolveum.com"><a class="moz-txt-link-abbreviated" href="mailto:midpoint-bounces@lists.evolveum.com">midpoint-bounces@lists.evolveum.com</a></a>>
on behalf of Devin Rosenbauer <<a moz-do-not-send="true"
href="mailto:devin@identityworksllc.com">devin@identityworksllc.com</a>><br>
<span style="font-weight:bold">Reply-To: </span> midPoint
General Discussion <<a moz-do-not-send="true"
href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>><br>
<span style="font-weight:bold">Date: </span> Friday, April 1,
2016 at 9:51 AM<br>
<span style="font-weight:bold">To: </span> midPoint General
Discussion <<a moz-do-not-send="true"
href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>><br>
<span style="font-weight:bold">Subject: </span> Re:
[midPoint] Storing passwords in Midpoint<br>
</div>
<div><br>
</div>
<div dir="ltr">Typically an identity manager needs access to the
user's password in cleartext so that it can be set on other
systems, e.g. setting the user's initial password on a new
account, etc.<br>
</div>
<div class="gmail_extra"><br>
<div class="gmail_quote">On Fri, Apr 1, 2016 at 12:45 PM,
Florin. Stingaciu <span dir="ltr"><<a
moz-do-not-send="true"
href="mailto:fstingaciu@mirantis.com" target="_blank"><a class="moz-txt-link-abbreviated" href="mailto:fstingaciu@mirantis.com">fstingaciu@mirantis.com</a></a>></span>
wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0
.8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr">Hello,
<div><br>
</div>
<div>From my understanding passwords in Midpoint are
encrypted using an 256-bit AES key and then stored in
the Midpoint DB. I was wondering if there is any sort
of hash applied to password before it's encrypted. If
not, is there a purpose for having access to the clear
text password?</div>
<div><br>
</div>
<div>Thanks, </div>
<span class="HOEnZb"><font color="#888888">
<div>-F </div>
</font></span></div>
<br>
_______________________________________________<br>
midPoint mailing list<br>
<a moz-do-not-send="true"
href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br>
<a moz-do-not-send="true"
href="http://lists.evolveum.com/mailman/listinfo/midpoint"
rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br>
<br>
</blockquote>
</div>
<br>
<br clear="all">
<br>
-- <br>
<div class="gmail_signature">
<div dir="ltr">Devin Rosenbauer<br>
Principal Consultant<br>
Identity Works LLC<br>
+1 585 210 3201<br>
</div>
</div>
</div>
</span>
<br>
<fieldset class="mimeAttachmentHeader"></fieldset>
<br>
<pre wrap="">_______________________________________________
midPoint mailing list
<a class="moz-txt-link-abbreviated" href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a>
<a class="moz-txt-link-freetext" href="http://lists.evolveum.com/mailman/listinfo/midpoint">http://lists.evolveum.com/mailman/listinfo/midpoint</a>
</pre>
</blockquote>
<br>
<br>
</body>
</html>