Credential managment
Hi Team,
we need to store the credentials in the encrypted format in application.
do we have any feasible solution on this.
Thanks in advance.
Pegasystems Inc.
US
Kiran,
Can you provide more details on what you are looking for and what the environment is. Are you using out of the box authentication or an external authentication provider? Do you mean encrypted or hashed?
Matt
DXC
IN
Hi Matt,
we ran a veracode tool against to application, there it generates a Application Security Report.
In the report, we got a flaw --> Credentials Management.
In my application, we are using out of the box authentication only.
The flaw is as follows
Improper management of credentials, such as usernames and passwords, may compromise system security. In particular,
storing passwords in plaintext or hard-coding passwords directly into application code are design issues that cannot be easily
remedied.
DXC
IN
Hi Matt,
Actually I created an SR earlier,
The support team suggested us to implement the JCE, which is a part of the Java Cryptography Architecture (JCA),
The solution says that each and every user password needs to generate a JCE-keyring-file and the generated file needs to save in some folder at application server level and we wont have any constant users in this application. In the existing application we are adding/deleting minimum of 10 users daily.
So this is not a fie-sable solution.
Thanks for your time and support.