Re: Tivoli Identity Manager.

On 02-Jun-2010 13:13, rob@xxxxxxxxx wrote:

We're in the process of installing Tivoli Identity Manager to
sync passwords with various systems. It has a hook into the
QPWDVLDPGM system value using *REGFAC to process CHGPWD and send
it on into TIM. Odd thing is that it insists on using SSL to talk
to the TIM server, but stores the password in the clear in your
joblog and in /QIBM/UserData/tivoli/qpwdsync.log

A sample from the qpwdsync.log:
... userDN="erUid=TTEST" pswd="NEWPWD" ...

A sample from the job log:
CPF9898 Diagnostic 40 06/02/10 13:55:59.523017
QITIMPWSYN QITIM *STMT QITIMPWSYN QITIM *STMT
From module . . . . . . . . : QITIMPWSYN
From procedure . . . . . . : WriteLogEntry__6LoggerFPcT1
Statement . . . . . . . . . : 15
To module . . . . . . . . . : QITIMPWSYN
To procedure . . . . . . . : WriteLogEntry__6LoggerFPcT1
Statement . . . . . . . . . : 15
Message . . . . : POST /passwordsynch/synch
HTTP/1.0 Host:...IP ADDR...:9443
Content-type: text/xml content-length: 270 connection:
close<?xml version="1.0" encoding="UTF-8"?> <PSWD_REQ_MSG>
<CREDENTIALS principal="ROB" pswd=""/>
<REQUEST op="synch" srcDN="erglobalid=...somenumbers...,ou=
services,erglobalid=...moreNumbers... 0000,ou=Dekko,dc=com"
userDN="erUid=TTEST" pswd="NEWPWD"/> </PSWD_REQ_MSG> .
Cause . . . . . : This message is used by application
programs as a general escape message.

Note: Look for the pswd with NEWPWD.

The password appearing in-the-clear in the joblog or a log file for a successful password change request is, in my experience, long considered by IBM [Rochester] as a Security\Integrity problem. Notice that one occurrence of /pswd=/ was recorded as /pswd=""/, while another was recorded as /pswd="NEWPWD"/. I suspect that some find\replace processing may have failed to complete for all occurrences; i.e. the code seems to have expunged one password within the string, the credentials of the requester, but failed to effect that same action for the password in the credentials being synchronized.

Regards, Chuck