On 02-Jun-2010 13:13, rob@xxxxxxxxx wrote:
We're in the process of installing Tivoli Identity Manager to
sync passwords with various systems. It has a hook into the
QPWDVLDPGM system value using *REGFAC to process CHGPWD and send
it on into TIM. Odd thing is that it insists on using SSL to talk
to the TIM server, but stores the password in the clear in your
joblog and in /QIBM/UserData/tivoli/qpwdsync.log

A sample from the qpwdsync.log:
... userDN="erUid=TTEST" pswd="NEWPWD" ...

A sample from the job log:
CPF9898 Diagnostic 40 06/02/10 13:55:59.523017
QITIMPWSYN QITIM *STMT QITIMPWSYN QITIM *STMT
From module . . . . . . . . : QITIMPWSYN
From procedure . . . . . . : WriteLogEntry__6LoggerFPcT1
Statement . . . . . . . . . : 15
To module . . . . . . . . . : QITIMPWSYN
To procedure . . . . . . . : WriteLogEntry__6LoggerFPcT1
Statement . . . . . . . . . : 15
Message . . . . : POST /passwordsynch/synch
HTTP/1.0 Host:...IP ADDR...:9443
Content-type: text/xml content-length: 270 connection:
close<?xml version="1.0" encoding="UTF-8"?> <PSWD_REQ_MSG>
<CREDENTIALS principal="ROB" pswd=""/>
<REQUEST op="synch" srcDN="erglobalid=...somenumbers...,ou=
services,erglobalid=...moreNumbers... 0000,ou=Dekko,dc=com"
userDN="erUid=TTEST" pswd="NEWPWD"/> </PSWD_REQ_MSG> .
Cause . . . . . : This message is used by application
programs as a general escape message.

Note: Look for the pswd with NEWPWD.


The password appearing in-the-clear in the joblog or a log file for a successful password change request is, in my experience, long considered by IBM [Rochester] as a Security\Integrity problem. Notice that one occurrence of /pswd=/ was recorded as /pswd=""/, while another was recorded as /pswd="NEWPWD"/. I suspect that some find\replace processing may have failed to complete for all occurrences; i.e. the code seems to have expunged one password within the string, the credentials of the requester, but failed to effect that same action for the password in the credentials being synchronized.

Regards, Chuck

This thread ...

Follow-Ups:

Follow On AppleNews
Return to Archive home page | Return to MIDRANGE.COM home page

This mailing list archive is Copyright 1997-2020 by midrange.com and David Gibbs as a compilation work. Use of the archive is restricted to research of a business or technical nature. Any other uses are prohibited. Full details are available on our policy page. If you have questions about this, please contact [javascript protected email address].