Am I able to decrypt the ObSSOCookie?

Question

Am I able to decrypt the ObSSOCookie?

Answer 1

Hi,
The secret is in the directory, I don't have the exact DN here, but the name is rather suggestive. So if you are the owner of the installation it's quite easy to obtain the secret. But knowing the secret and the algorithm (which you can choose from the OAM console) didn't get me far. There seems to be some security-through-obscurity in the mix as well.
However, using the API it is very straightforward to query the contents of the cookie. Basically you install the SDK, configuring it to use an Access or Webgate configuration with the ASDK enabled, and then run your code, something like this:
try {
ObConfig.initialize("C:\\Program Files\\NetPoint\\AccessServerSDK"); // SDK path
String cookie = "F6qff9y..."; // cookie cut to save space
ObUserSession sess = new ObUserSession(cookie);
System.out.println("user: " + sess.getUserIdentity());
System.out.println("last use: " + new Date(sess.getLastUseTime()*1000L));
System.out.println("level: " + sess.getLevel());
System.out.println("location: " + sess.getLocation());
System.out.println("start: " + new Date(sess.getStartTime()*1000L));
System.out.println("status: " + sess.getStatus());
System.out.println("error: " + sess.getErrorMessage());
ObConfig.shutdown();
} catch (Exception ex) {
ex.printStackTrace();
BR,
Sami