<html><head></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space; color: rgb(0, 0, 0); font-size: 14px; font-family: Calibri, sans-serif;"><div>So why not use a temporary mechanism push the cleartext password between components (memory/pipe/TLS channel). Keeping the ALL passwords in cleartext is an unnecessary risk, any plans to move away from this?</div><div><br></div><div>Camilo</div><div><br></div><span id="OLK_SRC_BODY_SECTION"><div style="font-family:Calibri; font-size:11pt; text-align:left; color:black; BORDER-BOTTOM: medium none; BORDER-LEFT: medium none; PADDING-BOTTOM: 0in; PADDING-LEFT: 0in; PADDING-RIGHT: 0in; BORDER-TOP: #b5c4df 1pt solid; BORDER-RIGHT: medium none; PADDING-TOP: 3pt"><span style="font-weight:bold">From: </span> midPoint <<a href="mailto:midpoint-bounces@lists.evolveum.com">midpoint-bounces@lists.evolveum.com</a>> on behalf of Devin Rosenbauer <<a href="mailto:devin@identityworksllc.com">devin@identityworksllc.com</a>><br><span style="font-weight:bold">Reply-To: </span> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>><br><span style="font-weight:bold">Date: </span> Friday, April 1, 2016 at 9:51 AM<br><span style="font-weight:bold">To: </span> midPoint General Discussion <<a href="mailto:midpoint@lists.evolveum.com">midpoint@lists.evolveum.com</a>><br><span style="font-weight:bold">Subject: </span> Re: [midPoint] Storing passwords in Midpoint<br></div><div><br></div><div dir="ltr">Typically an identity manager needs access to the user's password in cleartext so that it can be set on other systems, e.g. setting the user's initial password on a new account, etc.<br></div><div class="gmail_extra"><br><div class="gmail_quote">On Fri, Apr 1, 2016 at 12:45 PM, Florin. Stingaciu <span dir="ltr"><<a href="mailto:fstingaciu@mirantis.com" target="_blank">fstingaciu@mirantis.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">Hello, <div><br></div><div>From my understanding passwords in Midpoint are encrypted using an 256-bit AES key and then stored in the Midpoint DB. I was wondering if there is any sort of hash applied to password before it's encrypted. If not, is there a purpose for having access to the clear text password?</div><div><br></div><div>Thanks, </div><span class="HOEnZb"><font color="#888888"><div>-F </div></font></span></div><br>_______________________________________________<br>
midPoint mailing list<br><a href="mailto:midPoint@lists.evolveum.com">midPoint@lists.evolveum.com</a><br><a href="http://lists.evolveum.com/mailman/listinfo/midpoint" rel="noreferrer" target="_blank">http://lists.evolveum.com/mailman/listinfo/midpoint</a><br><br></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature"><div dir="ltr">Devin Rosenbauer<br>Principal Consultant<br>Identity Works LLC<br>+1 585 210 3201<br></div></div></div></span></body></html>