Runtime Communication Channel Password

Question

Hopefully, I am posting this in the correct Forum.
We have a new application, Password Vault, where the company would like to change all passwords on a daily basis. Password Vault has a Java API that will allow me to obtain the password for a specific account. What I would like to know is whether there is a way in PI to create a module that will be called by the Communication Channle when it requires the password which will aloow me to dynamically pass the password to the Communication Channel.
In short, I would like to step in front of all runtime password requests and push the current password to the Communication Channel.
Is this possible and/or where can I go to find more information?

Answer 1

>
Larry Martin wrote:
> I should have said that we will change all passwords used by PI...and some other applications...on a daily basis.
>
> Actually, it is a good idea because the passwords are managed by Password Vault so we would never have to worry about a password in PI. Everytime a Communication Channel needed a passwrod it would request it from Password Vault. We would not care if they changed them once a day or once a minute since we would no longer have any responsibility for managing passwords...we would simply use whatever password was the current one.
>
> It greatly improves our protection because the passwords would all be random, all have 15 characters (where possible) and would change so often that stealing a password would be of little value.
>
> The rules would not apply to user passwords in AD, in databases or to logon to PI or SAP because, as you mention, noone could keep track of a password that changes daily.
Well, an even better approach is not to use passwords at all - but use SNC or X.509 Client Certificates (SSL) for authentication.
As long as you are using passwords, there is the risk of password locks that will result from exceeding the number of permissible failed password logon attempts. Such failing attempts might not necessarily indicate a hacking attempt but could also result from a failure of your password provisioning solution. Especially in the case of inter-system communication the number of logon attempts per (small) time unit is fairly high. So, even if you run only shortly out of sync (regarding passwords) you might suffer from the resulting locks. So, better do not use passwords if it's avoidable.