Focal Point Banner


As of December 1, 2020, Focal Point is retired and repurposed as a reference repository. We value the wealth of knowledge that's been shared here over the years. You'll continue to have access to this treasure trove of knowledge, for search purposes only.

Join the TIBCO Community
TIBCO Community is a collaborative space for users to share knowledge and support one another in making the best use of TIBCO products and services. There are several TIBCO WebFOCUS resources in the community.

  • From the Home page, select Predict: WebFOCUS to view articles, questions, and trending articles.
  • Select Products from the top navigation bar, scroll, and then select the TIBCO WebFOCUS product page to view product overview, articles, and discussions.
  • Request access to the private WebFOCUS User Group (login required) to network with fellow members.

Former myibi community members should have received an email on 8/3/22 to activate their user accounts to join the community. Check your Spam folder for the email. Please get in touch with us at community@tibco.com for further assistance. Reference the community FAQ to learn more about the community.


Focal Point    Focal Point Forums  Hop To Forum Categories  WebFOCUS/FOCUS Forum on Focal Point     [SOLVED] &IBIC_pass Exposed

Read-Only Read-Only Topic
Go
Search
Notify
Tools
[SOLVED] &IBIC_pass Exposed
 Login/Join
 
Yazster
Silver Member
posted
Hi,

Can anybody please explain to me why my &IBIC_pass variable is exposed?

I'm using LDAP security (Trusted) and when I type 
-TYPE &IBIC_pass
it shows me the user's LDAP password.
This is happening in my DEV environment but not in production. For the life of me I can't seem to locate the config difference between the two that would allow this behavior.

Many thanks! Smiler

This message has been edited. Last edited by: Yazster,


WebFOCUS 8.201M
Windows, Linux, All Outputs
 
Posts: 47 | Location: Montreal, QC, Canada | Registered: October 15, 2014Report This Post
CoolGuy
Virtuoso
posted Hide Post
WF Admin Console -> Configuration -> Custom Settings.

Take out the line for &IBIC_pass and save.

Check setting for both environments.


8.2.02M (production), 8.2.02M (test), Windows 10, all outputs.
 
Posts: 1113 | Location: USA | Registered: January 27, 2015Report This Post
Yazster
Silver Member
posted Hide Post
Thanks for that, seems to have done the trick.

Oddly enough though, both environments have the same custom settings, and yet my production environment doesn't expose the passwords...

Guessing there's another setting somewhere...

<SET> IBIMR_user(PASS)
<SET> IBIMR_pass(PASS)

<SET> IBIC_user(PASS)
<SET> IBIC_pass(PASS)


WebFOCUS 8.201M
Windows, Linux, All Outputs
 
Posts: 47 | Location: Montreal, QC, Canada | Registered: October 15, 2014Report This Post
MattC
Guru
posted Hide Post
Is both your DEV and Prod on 8.1.4? Just curious. I tested it on 8.00.8 and it does not expose the password. I do have an 8.1.4 environment, but I haven't tested it.


WebFOCUS 8.1.05
 
Posts: 496 | Registered: January 04, 2008Report This Post
Yazster
Silver Member
posted Hide Post
Yes both are 8.104.

I had the settings previously on 8.008 and all worked fine, no passwords were exposed. After upgrading both environments, passwords were exposed in my dev environment. No changes (to my knowledge) were made to either environment.


WebFOCUS 8.201M
Windows, Linux, All Outputs
 
Posts: 47 | Location: Montreal, QC, Canada | Registered: October 15, 2014Report This Post
MattC
Guru
posted Hide Post
I tried it in my 8.1.4 environment, but I am not seeing it, in fact I am getting prompted or getting an error that it can't find the value, depending on where I am running it from, either MRE or RS.

I kind of wonder why you would have IBIMR_pass(PASS) set in your custom settings. That's not very secure.

We use LDAP along with SiteMinder, so anything I want to pass from LDAP, I have our LDAP admin throw it into the SM_HEADER to secure it properly. Otherwise you could have some spoofing.

By any means I am no expert. 

 

-SET &ECHO='ALL';

-TYPE &IBIC_pass

TABLE FILE CAR
PRINT COUNTRY
END
-RUN


WebFOCUS 8.1.05
 
Posts: 496 | Registered: January 04, 2008Report This Post
Yazster
Silver Member
posted Hide Post
The IBIMR_pass (PASS) statement was added by an IBI consultant when they created an initial application for us. Not really sure if/why it is required.

Removing the &IBIC_pass from the Custom Settings seems to have resolved the issue. This doesn't seem to have impacted anything negatively, I suppose time will tell Smiler

Thanks for your help guys, much appreciated!


WebFOCUS 8.201M
Windows, Linux, All Outputs
 
Posts: 47 | Location: Montreal, QC, Canada | Registered: October 15, 2014Report This Post
  Powered by Social Strata  

Read-Only Read-Only Topic

Focal Point    Focal Point Forums  Hop To Forum Categories  WebFOCUS/FOCUS Forum on Focal Point     [SOLVED] &IBIC_pass Exposed

Copyright © 1996-2020 Information Builders