Password Encryption

[Corrie_Kantowsk]

According to the Perceptive Content Server Installation and Setup Guide Version: Foundation 22.2:

1) The password supplied in the odbc.user.password setting is consumed by the application for encryption in the odbc.user.password.encrypted setting.

2) The password supplied in the mq.password setting is consumed for encryption in the mq.password.encrypted setting. This value is encrypted and removed from the mq.password setting after running the inserver –encrypt-config command.

3) The password supplied in the mq.client.password setting is consumed for encryption in the mq.client.password.encrypted setting. This value is encrypted and removed from the mq.password setting after running the inserver –encrypt-config command.

I have 2 questions:

1) Does the inserver -encrypt-config command encrypt the odbc.user.password? I am not sure what is meant by "consumed by the application".

2) The 3 above-mentioned passwords are located in the inow.ini file. There is one additional password in the inow.ini file that is not mentioned - LDAP.password. Is this password also encrypted when the inserver -encrypt-config is run? If so, is there a chance that this command does not always work on this field? It is not encrypted in my inow.ini, but the other passwords are.

Thank you

[Dave_Clevenger · Accepted solution]

I think when it says "consumed" it means those fields will become empty values when you run the -encrypt-config command, they are replaced with the encrypted version of that field for example:

odbc.user.password.encrypted=<encrypted password>

[BrandonCrespino · Accepted solution]

Hi @Corrie K - When we start the inserver process we read the database/ODBC setting. If there is a value in the unencrypted section we attempt to use that value for the connection and then will encrypt and place in the encrypted setting. The ODBC setting is a little different than the others since we do this automatically. The other settings that have a password  will be encrypted when the -encrypt-config flag is used. The areas that would have encrypted passwords would be ODBC, Message Queue, and LDAP.

If you are not seeing LDAP getting encrypted then this would be unexpected and I would recommend opening a support case so that we can have someone take a look.

[Corrie_Kantowsk · Accepted solution]

Just one last question, can it be unencrypted, if needed?

[BrandonCrespino]

Hi @Corrie K  - It cannot. If an error is made with the password or it changes then the value will need to be cleared, the update entered, and then encrypted again. There is no decryption option.