Encrypting IIQ Login Password

IdentityIQ (IIQ) IIQ Discussion and Questions
1

Which IIQ version are you inquiring about?

8.4

Hi

When logging to the SailPoint IIQ the password is going as a plain text, we can observe it in the payload.

image
image844Ă—211 18.2 KB

This is the post request form data:

image
image1495Ă—154 9.59 KB

Client side password Encryption is not happening.

My requirement is to encrypt the password.
Thanks!!

2

Hi @Akhila_2001

  1. how to encrypt password:

From iiq console you can encrypt the password with below command.

syntax:

> encrypt <string>

image
image874Ă—105 4.21 KB

for example: we will configure Databse password at iiq.properties file using above syntax.

  1. What is you application access URL?

did you configure secure port at server.xml

Access URL:

  • Always access your IdentityIQ instance using https://hostname/identityiq/. If you’re using http://, the browser will send the password in plain text.
<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
           maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
           clientAuth="false" sslProtocol="TLSv1.2,TLSv1.3"
           keystoreFile="/path/to/your/keystore.jks" keystorePass="your_keystore_password" />
3

Hi @pattabhi I’m using self signed certificate at port 8443 during login still the password is showing as plain text in the payload, my requirement is to encrypt the password.

4

Hi @Akhila_2001

I am able to replicate the scenario, let me research and get back to you.

1 Like
6

If you’re using TLS, your payload is encrypted inside of the TLS session. You’re looking at local data. Your computer knows the password because you typed the password. Can you see the password if you capture the network traffic? You shouldn’t be able to unless you have the private key that decrypts the TLS session.

The problem with this is that if HTTPS ever gets downgraded to HTTP through a configuration error or exploit or someone gains access to your private key, they can see all of this traffic in plain text.

The best way to fix this is to implement SSO and remove passwords from the equation entirely.

1 Like
7

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.