Hello,
We are currently working on the migration of the users and passwords from Top Secret to eDirectory. For the password sync, it works with a developed custom exit module for Top Secret´s TSSINSTX exit. This custom exit can be used by enabling the following matrix options in TSSINSTX:
DC AL1(#####YES) 32 NEW PASSWORD VERIFICATION
DC AL1(#####YES) 48 SECURITY FILE CHANGE
DC AL1(#####YES) 104 NEW PW PHRASE VERIFICATION
By doing so, this custom exit will capture and log password changes, pass phrase changes and security database changes to a changelog, where it can be processed by the vendor’s event processing engine. The third option is where we are running into problems.
It used to be that when TSS commands were issued with password data in them, we would have access to the raw, cleartext password:
TSS REPLACE (ACID) PASSWORD (abcd123)
However, with the introduction of AES encryption on Top Secret databases, this is no longer the case. Now we are seeing a command like:
TSS REPLACE (ACID) PASSWORD ( ) AEPWDAT2(X.)W#;.%.bRI.#&#J..e3-)
Omnibond Systems (the developers of the custom exit), have tried many ways to interpret the AEPWDAT2 field, to see if their database hex encryption key could be used to perform a decryption with no luck.
Documentation regarding this field is sparse.
What we are looking for is to be able to retrieve the password when it changes through the TSS command or reconstruct it in some way with the Omnibond eventing engine. Is this possible in any way?
Best regards,
J.Sancho