R12: New Feature: Enhance Security With Non-Reversible Hash Password (Doc ID )

Transcription

1 R12: New Feature: Enhance Security With Non-Reversible Hash Password (Doc ID ) In this Document Goal Using AFPASSWD to Migrate to a Password Hashing Scheme Solution Client Prerequisites: Known Issues References APPLIES TO: Oracle Application Object Library - Version to 12.2 [Release 12 to 12.2] Information in this document applies to any platform. PATCHSET:11I.ATG_PF.H.DELTA.6 Oracle Applications Release: Oracle Applications Release:12.1.x + patch :R12.FND.B Oracle Applications Release: patch :R12.FND.C Note: The option to migrate to the SHA hash mode is deprecated in Release ATG , and higher. You should now migrate to SHA-256, SHA-384, or SHA-512. Please see the 12.2 E-Business Suite Maintenance Guide -> "Using AFPASSWD to Migrate to a Password Hashing Scheme". This section is also applicable to 12.1 release back-port and i have copied it below for your reference. ***Checked for relevance on 25-NOV-2012*** GOAL Using AFPASSWD to Migrate to a Password Hashing Scheme You can optionally use AFPASSWD to migrate Oracle E-Business Suite user passwords to a password hashing scheme. The migration converts the passwords for local Oracle E-Business Suite users (that is, users stored in the FND_USER table) from their current encryption to a non-reversible password hashing scheme, thus making the passwords non-recoverable. This feature provides additional protections against brute forcing of hashes in case the password hashes in the database are compromised. You can select SHA-2 algorithms (SHA-256, SHA-384, and SHA-512) defined by NIST FIPS which are combined internally with the use of the PBKDF2 derivation function as defined by NIST to make calculating the hashes computationally more difficult. Please apply patch for bug to get latest FND Hash code (patch :R12.FND.B for 12.1.x and :R12.FND.C for 12.2.x) before running the password hash migration. Note: The option to migrate to the SHA hash mode is deprecated in Release ATG , and higher. You should now migrate only to SHA-256, SHA-384, or SHA-512. However, if you previously migrated to the SHA hash mode, you can use AFPASSWD to perform another migration to one of the advanced hash modes. Migration to a password hashing scheme is a one-way operation that cannot be undone without a system restore from backup. This migration is optional and is not implemented unless you manually execute it to take advantage of this feature. Oracle recommends that you do implement an advanced password hashing scheme to enhance Oracle E-Business Suite user password security. Using an advanced hash algorithm adds a small delay to the login process for users due to the additional computation. Oracle recommends that you use advanced password hashing with the strongest SHA-2 algorithm that provides acceptable login performance. Note: The AFPASSWD migration option does not affect existing password schemes for the following types of users: Users whose passwords are managed externally in Oracle Internet Directory Users whose passwords are managed externally in a third-party LDAP directory, such as Microsoft Active Directory Oracle E-Business Suite database users Before migrating, back up your Oracle E-Business Suite instance so that you can restore it from the backup if necessary. Also, before migrating, verify that you have upgraded all desktop clients to a version supported with Release 12.2 to ensure that these clients can continue to connect to your Oracle E-Business Suite instance. These clients include the following: Oracle Collaboration Suite - See the Oracle Collaboration Suite Installation Guide for your platform. Oracle Configurator - See the Oracle Configurator Installation Guide. Oracle Demand Planning - See Release 12.2.x Oracle Value Chain Planning Installation Notes, My Oracle Support Document Oracle Discoverer - See Using Discoverer with Oracle E-Business Suite Release 12.2, My Oracle Support Document

2 Note: If you plan to export Oracle E-Business Suite users for bulk loading into Oracle Internet Directory, you should perform the export and bulk load before you migrate Oracle E-Business Suite user passwords to a password hashing scheme. After you implement password hashing, the AppsUserExport utility can no longer include the passwords when exporting Oracle E-Business Suite user information. See: Migrating Data between Oracle E-Business Suite and Oracle Internet Directory, Oracle E-Business Suite Security Guide. To migrate Oracle E-Business Suite user passwords to a password hashing scheme, specify the AFPASSWD command with the following options. AFPASSWD [-c <APPSUSER>[@<TWO_TASK>]] -m <HASH_MODE> {FULL BACKGROUND PARTIAL} -c <APPSUSER>[@<TWO_TASK>] - Specify the connection string to use, the Oracle E-Business Suite user, and/or the value of TWO_TASK. This option can be use in combination with others. If it is not specified, default values from the environment will be used. Note: The password will be prompted for, and should not be provided in the connection string. -m - Migrates records in the FND_USER table to hash mode using the specified algorithm. Specify the hash mode to use. You can specify any of the following advanced hash algorithms: SHA256 SHA384 SHA512 Note: The SHA hash mode is deprecated in Release and higher. Do not specify SHA as the hash mode for AFPASSWD; instead, specify one of the advanced SHA-2 hash algorithms. Specify the type of advanced hash migration to perform. FULL - A full migration migrates all the records in the FND_USER table to the selected hash mode. If you do not specify a migration type, then a full migration is performed by default. BACKGROUND - A background migration migrates all the records in the FND_USER table to the selected advanced hash mode in the background as a concurrent program named Advanced Hash Migration (AFPASSWD_MIGRATION). PARTIAL - A partial migration allows users with an earlier encryption mode to co-exist with users creating new passwords with the selected advanced hash mode. Users on the earlier encryption mode can still log in, but subsequent password changes will switch these users to the selected advanced hash mode. Note: Partial migration is used to change between advanced hash modes and should be performed only after a full or background migration. If you perform a partial migration first, then you cannot perform a full migration in the future. If you are already using an advanced hash mode (SHA256, SHA384, or SHA512), then you can only migrate to another advanced hash mode, and you can only specify the migration type PARTIAL. The AFPASSWD log file is written to the directory where AFPASSWD was executed. You should review this log file to verify the status of the migration. Note: After you have migrated to a password hashing scheme, you may encounter an issue when using the expdp database export utility in which the FND_USER_PREFERENCES table is not properly exported. As a workaround to resolve this issue, you can re-export and re-import the FND_USER_PREFERENCES table separately using the exp and imp utilities, after initially running expdp and impdp. 1. Immediately after running expdp and impdp, use the exp utility to export the FND_USER_PREFERENCES table from the source database with the following command: exp TABLES=(<APPLSYS SCHEMA NAME>.FND_USER_PREFERENCES) COMPRESS=Y DIRECT=Y For example: exp TABLES=(APPLSYS.FND_USER_PREFERENCES) COMPRESS=Y DIRECT=Y When prompted, enter the user to run the utility, such as SYSTEM, and the password for that user. 2. Then import this data into the target database using the following command: imp FILE=expdat.dmp LOG=imptab.log TABLES=FND_USER_PREFERENCES FROMUSER=<APPLSYS SCHEMA NAME> IGNORE=Y For example: imp FILE=expdat.dmp LOG=imptab.log TABLES=FND_USER_PREFERENCES FROMUSER=APPLSYS IGNORE=Y When prompted, enter the user to run the utility, such as SYSTEM, and the password for that user.

3 Information below is for extended support releases and left here for historical reference This note explains the usage of a new FNDCPASS Utility introduced in RUP 6 and to migrate Oracle Applications User passwords to a non-reversible hash password scheme with a single command line invocation. Starting with Releases RUP 6 and , a single command line invocation of FNDCPASS USERMIGRATE utility migrates the encrypted passwords for all local Oracle Application Users (i.e. passwords for all users stored in FND_USER) to a non-reversible hash password scheme. This utility does not affect existing password schemes for: Users whose passwords are managed externally in Oracle Internet Directory Users whose passwords are managed externally in a third-party LDAP directory (e.g. Microsoft Active Directory) Oracle Applications Database users This feature was provided as part of an initiative to enhance the security of Oracle Applications User Passwords. This System Administrative utility migrates local Oracle Applications User Passwords from their current encryption scheme to a non-reversible hash thus making Oracle Application User Passwords non-recoverable. This is an optional, manually executed utility provided for System Administrators who wish to convert the Applications Users to a more secure encrypted password scheme. Note: Migration to hash passwords is one-time, one-way operation that cannot be undone without a system restore from backup. Please make sure you have a backup of your system prior to running FNDCPASS USERMIGRATE. Systems which remain with the existing password encryption scheme will experience no impact from the code supporting the non-reversible hash password scheme. For migrated systems, the effects of the migration should be transparent. Note: The code supporting the non-reversible hash password scheme is delivered in compatibility mode, i.e. hash mode is "turned off" by default until explicitly activated. Oracle recommends you implement the non-reversible hash password scheme to enhance FND_USER password security. However, if your installation uses Desktop Clients listed below and no update path is mentioned, please log a Service Request via Metalink against the affected products to verify that they have been tested with the new FNDPUB, and to verify that you have any required interoperability fixes and client updates prior to migrating to the password hash scheme. Note: If your installation is on a CU2 upgraded to 11i.ATG_PF.H RUP6 (# ) with Scheduler (CSR) implemented and SSO or Hash Password is configured, when available, download and apply Patch (CSR). Also, RUP6 alone does NOT cause this issue for CSR, but after migration to hashed passwords or if integrated with SSO. Note: If your installation is on a CU2 upgraded to 11i.ATG_PF.H RUP6 (# ) with CADView-3D implemented and Hash Password is configured, when available, download and apply Patch (Oracle CADView-3D) as a post Hash migration step. Note: When upgrading to Oracle E-Business Suite Release , if you have already run the FNDCPASS Utility to use Enhanced Security With Non-Reversible Hash Passwords you must merge or pre-install Patch :R12.FND.B before you upgrade. Please follow the instructions in the README of that patch. Note: Once migrated to hashed passwords, you may encounter Bug if you use the Export utility, expdp. The cause of this issue is that the FND_USER_PREFERENCES table did not get exported properly due to a feature, that is now covered in Note Section 3: Step 4. If you missed that step immediately go back and redo the full steps in Note Optionally, a workaround is to apply the grant from Step 4 then re-export/re-import the FND_USER_PREFERENCES table separately after the initial expdp and impdp are run. Using the old exp utility, export the FND_USER_PREFERENCES table from the source db. exp system/<system pwd> TABLES=(<APPLSYS SCHEMA NAME>.FND_USER_PREFERENCES) COMPRESS=Y DIRECT=Y

4 For example, exp system/manager TABLES=(APPLSYS.FND_USER_PREFERENCES) COMPRESS=Y DIRECT=Y Then, import this data into the target db using this command: imp system/<system pwd> FILE=expdat.dmp LOG=imptab.log TABLES=FND_USER_PREFERENCES FROMUSER=<APPLSYS SCHEMA NAME> IGNORE=Y For example, imp system/manager FILE=expdat.dmp LOG=imptab.log TABLES=FND_USER_PREFERENCES FROMUSER=APPLSYS IGNORE=Y Please note, this will only fix this one table and allow login to the system, but other tables may also be using VPD policies and not following Note completely could have other unknown downstream effects. Any final production system should only be done using the steps from Note ALERT: Oracle Financial Analyzer Version: 6.4 or Oracle Sales Analyzer Version: 6.4 using the Single Sign On (SSO) mechanism, please see Note SOLUTION Client Prerequisites: Before migrating you must upgrade ALL Desktop clients to the latest version of the FNDPUB DLL/Libraries or they will no longer be able to connect until updated. Please contact respective Client team for the latest DLL/Lib and any required client updates. If your clients will also be connecting to pre-atg.11i.rup5 systems, for the new client DLL/Lib to connect those systems you will need to apply Patch (Client Interoperability Patch for FNDPUB DLL database compatibility). For more information please see the included Document references. Oracle Discoverer NOTE: Using Discoverer with Oracle E-Business Suite 11i Oracle Configurator 11i10 Configurator Customers using Limited Edition VB developer, upgrade to Configurator build A(Patch ) or later and uptake Ltd Edition VB developer build 25-40A (Patch ) R12 Configurator Customers using Limited Edition VB developer, upgrade to Release 12 RUP4 or later and uptake Ltd Edition VB developer build 27-6 (Patch ) Oracle Applications Desktop Integrator (NOT Web ADI) Customers using ADI will need to upgrade to ADI 7.2 Rollup Patch 10 (Patch ) or later after upgrading to 11i.ATG.RUP6. Oracle Balanced Scorecard Oracle Files Online Express Oracle Demand Planning Optimal Flexible Architecture Oracle Sales Analyzer Use this command to convert all local Oracle Application User encrypted passwords to a non-reversible, non-recoverable hash scheme Bourne shell or Korn shell: FNDCPASS <logon> 0 Y <system/password> <mode> <algorithm> Use the above command with the following arguments. logon: The Oracle FND schema username/password. system/password: The username and password for the SYSTEM DBA account.

5 mode: USERMIGRATE algorithm: SHA Note: Currently only the SHA hash algorithm is supported. Other hash algorithms may be supported in the future. For example, the following command migrates the passwords of all users in FND_USER (except SSO users, invalid users and corrupt users) to non-reversible, non-recoverable hash passwords. FNDCPASS apps/apps 0 Y system/manager USERMIGRATE SHA The FNDCPASS log file is written to the directory where FNDCPASS was executed. Please check this log file for the status of the migration. This log file contains information regarding the results of USERMIGRATE. This includes any problems encountered and contains information about the number of users migrated successfully and indicates why other users were not migrated successfully. For example, here is an excerpt from a sample log file: Users migrated successfully : 1847 Users with External passwords : 0 Users with Invalid passwords : 4 Users not migrated : 1 of 1852 System was successfully converted to hash mode. Known Issues 1. Oracle Financial Analyser and Oracle Sales Analyzer do not work This is described in Note New Applications FNDCPASS Utility Feature Breaks OFA and OSA Single Sign-On 2. JDeveloper gives error "oracle.apps.fnd.framework.oaexception: Application: FND, Message Name: FNDSECURITY_APPL_USER_NOTAUTH" This is resolved in Patch IJDeveloper With OA Extension ARU FOR 11i10 RUP6 3. OAM Patch Wizard "Recomended Patches" fails This is resolved with Patch Patch Wizard: Support Hash Password REFERENCES NOTE: New Applications FNDCPASS Utility Feature Breaks OFA and OSA Single Sign-On PATCH: PATCH: PATCH: NOTE: Using Discoverer with Oracle E-Business Suite 11i Didn't find what you are looking for?