OIM 11gR1 decrypt password
http://oraclestack.blogspot.com/2013/05/oim-11g-r1-getting-oim-user-decrypted.html
OIM 11g R1: Getting OIM User Decrypted Password
Version: Oracle Identity Manager 11g R1
Description: If you look at the OIM.USR table, you'll notice that the password column is encrypted. There are several ways to get the password decrypted. I'll be showing you how to get the decrypted password by querying from the OIM database using the tcDataBaseClient. This requires you to set the client handle with the OIMClient object. The user who is logged in for the OIMClient needs to be an End-User Administrator in order to use the tcDatabaseClient. The “Design Console Access” attribute on the OIM User Profile determines whether a user is an End-User or an End-User Administrator. Below is a java application to get all the OIM users' passwords in plain text. Note: You can also query the OIM.PCQ table to get users' challenge questions and answers.
Description: If you look at the OIM.USR table, you'll notice that the password column is encrypted. There are several ways to get the password decrypted. I'll be showing you how to get the decrypted password by querying from the OIM database using the tcDataBaseClient. This requires you to set the client handle with the OIMClient object. The user who is logged in for the OIMClient needs to be an End-User Administrator in order to use the tcDatabaseClient. The “Design Console Access” attribute on the OIM User Profile determines whether a user is an End-User or an End-User Administrator. Below is a java application to get all the OIM users' passwords in plain text. Note: You can also query the OIM.PCQ table to get users' challenge questions and answers.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
| import Thor.API.Security.XLClientSecurityAssociation;import com.thortech.xl.dataaccess.tcDataBaseClient;import com.thortech.xl.dataaccess.tcDataProvider;import com.thortech.xl.dataaccess.tcDataSet;import com.thortech.xl.dataaccess.tcDataSetException;import java.util.Hashtable;import java.util.logging.Level;import java.util.logging.Logger;import javax.security.auth.login.LoginException;import oracle.iam.platform.OIMClient;/** * This class gets the OIM Client and uses that to establish a * connection to the OIM Schema. You can query the USR table and * get the password in plain text. * NOTE: The administrator credential must be used for the OIM Client. */public class DecryptedOIMPassword { public static void main(String[] args) { tcDataProvider dbProvider = null; OIMClient oimClient = null; try { String ctxFactory = "weblogic.jndi.WLInitialContextFactory"; //WebLogic Context String authwlConfigPath = "resources/config/authwl.conf"; //Path to login configuration String username = "xelsysadm"; //OIM Administrator String password = "Password1"; //Administrator Password System.setProperty("java.security.auth.login.config", authwlConfigPath); //set the login configuration Hashtable<string,string> env = new Hashtable<string,string>(); //use to store OIM environment properties env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL, ctxFactory); env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, oimServerURL); oimClient = new OIMClient(env); oimClient.login(username, password.toCharArray()); //login to OIM XLClientSecurityAssociation.setClientHandle(oimClient);//Needed for database client dbProvider = new tcDataBaseClient(); //Connection to OIM Schema tcDataSet dataSet = new tcDataSet(); //Stores the result set of an executed query String query = "SELECT * FROM USR"; //Query Users table //String query = "SELECT * FROM PCQ"; //Query Users Challenge Question dataSet.setQuery(dbProvider, query); //Set query and database provider dataSet.executeQuery(); //execute query and store results into dataSet object int records = dataSet.getTotalRowCount(); //Get total records from result set for(int i = 0; i < records; i++) { dataSet.goToRow(i); //move pointer to next record String plainTextPassword = dataSet.getString("USR_PASSWORD"); String userLogin = dataSet.getString("USR_LOGIN"); String userStatus = dataSet.getString("USR_STATUS"); System.out.printf("User Login: %s\nStatus: %s\nPassword: %s\n\n", userLogin, userStatus, plainTextPassword); //Getting user challenge questions and answers //String usrKey = dataSet.getString("USR_KEY"); //String question = dataSet.getString("PCQ_QUESTION"); //String answer = dataSet.getString("PCQ_ANSWER"); //System.out.printf("USR_KEY: %s\nQuestion: %s\nAnswer: %s\n", usrKey, question, answer); } } catch (tcDataSetException ex) { Logger.getLogger(DecryptedOIMPassword.class.getName()).log(Level.SEVERE, null, ex); } catch (LoginException ex) { Logger.getLogger(DecryptedOIMPassword.class.getName()).log(Level.SEVERE, null, ex); } finally { //close connections try{dbProvider.close();} catch(Exception e){} try{XLClientSecurityAssociation.clearThreadLoginSession();} catch(Exception e){} try{oimClient.logout();} catch(Exception e) {} } }//end main method }//end class |
instead of password in clear, getting *******. Can you help?
Best,
Marek.
is there any document that specifies that?
dataSet.getString("USR_PASSWORD") returns encrypted string
I am trying to decrypt passwords using the following OIM APIs:
String password = com.thortech.xl.crypto.tcCryptoUtil.decrypt(encryptedPassword, "DBSecretKey");
I followed "http://oraclestack.blogspot.com/2013/06/post-process-eventhandler-example.html". This works when the code is executed within OIM, but not with a remote OIMClient.