Does NW7.4 ABAP stack still not support usernametoken with digest password?

[Former Member]

Hello, experts,

I got the message from here that NW7.0 ABAP STACK can't support usernametoken with digest password.

Does NW7.4 ABAP stack still not support usernametoken with digest password?

or can I custom the method VERIFY_USERNAME_TOKEN in CL_WS_SECURITY_PROFILE to support usernametoken with digest password?

or does sap have any plan to support this security requirement?

Many thanks.

---------------------------------------------------------------

fangzj

[MichaelShea · Accepted solution]

This does not appear to have changed:

WS Security UsernameToken - User Authentication and Single Sign-On - SAP Library

[Former Member · Accepted solution]

Hi, Michael,

It's some pity to hear that. any way, thanks for your reply.

Do you have any idea if we can enhance the soap_security package?

I mean, Can I modify the method VERIFY_USERNAME_TOKEN to support it?

thanks again!

[MichaelShea · Accepted solution]

I asked my experts about your question. On the client side we support this. We cannot support digest passwords on the server side. We save passwords in hashed format on the server side. To support digest passwords, the client would either need to send the password in clear text so that the digest can be calculated or the server would have to store the password in clear text, so that the digest password can be calculated. From a security standpoint these are questionable ideas. Either an eavesdropper is picking up the passwords from the traffic or the attacker who breaks the server suddenly has all the passwords in clear text.

You can modify the method VERIFY_USERNAME_TOKEN, but if an upgrade comes along that changes this package, you'll be prompted for a correction import. Then you will either have to skip the upgrade or lose your customization.

-Michael

[Former Member · Accepted solution]

Hi, Michael,

thanks a million. you are so nice.

Yes, I know the fact that the storage password is in some hash style. but I don't understand why the

as java stack can support the digest password, and the as abap stack can't.

Does the as java stack keep the password in plain text?

-----------------------------------------------

fangzj

[MichaelShea · Accepted solution]

No they don't keep the pasword in plain text. As I understand it, they chose yet another method, but I do not know what it is. In any case it is a design decision.

[Former Member · Accepted solution]

OK.

Thanks again!

Have a nice day!

----------------------------------------------------------

fangzj