How to encrypt password in Forms10g while calling in batch mode

Question

We are migrating our Forms 6i batch jobs to Forms10g. There are two ways we can pass login
information.
1. In formsweb.cfg
2. Pass in URL string 'userid=username/password@connectstring'
In both cases the password is not secured. In option # 1 password is in the configuration file in plain text. In
second option # 2, its in the URL.
BTW, we are using HTTPS protocol while calling form in batch mode and we are not using SSO.
Is there a way, we can use data source in frmservlet while calling form in batch mode. Like in Java, we can create data source with indirect password, the password is encrypted.
Basically, we would like to encrypt our password, we have very strict security guidelines.
Please let us know if there are any options, how to encrypt password in Forms 10g
Regards,
Gufran

Answer 1

One option maybe the following :
- Create a file holding the encrpyted username/password on the application server side (in the working directory of your oracle forms application)
- As a parameter, pass the name of your file to the form
- when the form is getting called, read the name file in (TEXT_IO) and use the logon built-in with the value from the password file
How to create an encrpyted file :
- use the obfuscation toolkit to encrypt username/password@instance into a varchar2
- write this value to a file using oracle forms (TEXT_IO)
FUNCTION f_encrypt_string(p_key IN VARCHAR2)
RETURN VARCHAR2 IS v_encrypt_string VARCHAR2(2000) := 'N/A';
l_data VARCHAR2(2000);
BEGIN
-- if neccessary create a text where the length of the string
-- is diviteable by 8 (which is a requirement of dbms_obfuscation_toolkit)
l_data := RPAD(p_key, (TRUNC(LENGTH(p_key)/8)+1)*8, CHR(0));
DBMS_OBFUSCATION_TOOLKIT.DESEncrypt(input_string => l_data,
key_string => 'MagicKey',
encrypted_string=> v_encrypt_string);
RETURN (v_encrypt_string);
END;
Edited by: user434854 on Apr 8, 2009 5:17 AM