Password Self Service - Security

[Former Member]

Hello IDM Gurus,

I had a few questions around the security for the password self service / ABAP change password method:

How is the newly set password transmitted from IDM to a target ABAP system? (Cleartext, scrambled or encrypted?)

I ask since we have to pass in the decrypted password when using the ChangePassword of ABAP user method. Does IDM do something else to scramble it in the background when sending it across to the target ABAP system? or is there some other layer of security added on when transmitting the password?

I was also wondering, if it's absolutely required that there be an SNC connection between an IDM system and a target ABAP system in order to set a productive password? or can it also be done without an SNC connection? if so, how?

Thanks a lot in advance!

Best regards,

Sandeep

[mvoros · Accepted solution]

Hi,

it's in clear text. IdM calls BAPI BAPI_USER_CHANGE. It has been enhanced to allow setting productive password. It's mentioned in OSS note 1287410. They also added additional check for setting production password. RFC connection must be protected by SNC. So if you want to use standard functionality then no, you have to use SNC.

Cheers

[Former Member · Accepted solution]

Thanks a lot Martin for your quick response!

Cheers!

Sandeep