How to Keep Boj Passwords inSync with Oracle

[Brooks3204]

It seems that Boj requires that the password in Supervisor be exactly that same as it exists in Oralce (or Windows if Boj configured for Windows Authentication).

There doesn't seem to be any way via API or Boj Object Model to Change the user's password via program control.

Does anyone know of a way?

What is the sense of paying for the SDK when it lacks the basic functions of all systems that maintain a directory (User Accounts).

I was hopeful that the LDAP support in Boj 5.1.6+ would sove the proplems but it seems that the marketing hype about LDAP support is very missleading as there is little to no direct support of LDAP.

I'm in the process of writting a Change Password program that when the Windows (Active Directory) password changes, the old and new passwords are then used to change the user's Oracle Passwords at the same time. The problem is want and need to change the Business Objects password as well.

We are required to provide strong and expiring passwords.

When the passwords expire, Business Objects password is no longer insync with the Oralce password and the user cannot run any business objects reports (usually because too much time has passed to remember which old password was used for Business Objects so the user gets locked out). This now floods the help desk with too many calls. Now additional support required to reset all the user passwords to the same password and the user having to change them again on next logon.

This can all be avoided if Business Objects had a simple API of COM Interface for changing the user's password.

Also it would be great to write a network admin program that can create a user in all the systems where that user exists in a directory. I have such a program to do everything but the Business Objects Accounts.

If anyone knows a way to change the user's password via API or Com Interface, I'd love to hear from you.

-Brooks Vaughn
bvaughn@ftc.gov

 

[skrandel]

Can't you do it with the client SDK? Steve Krandel
BASE Consulting Group

http://www.baseconsulting.com

 

[pabloj]

It is not possible, because the crypt algorithm used by BO uses a key which is unknown to others, there is an enhancement request for this at BO, please add your request to it.
You can however set a password for a user manually, then get it encripted with a query on the repository and apply it to other users with an insert on the repository tables. I used this method for a password retrieval system which, upon user request:
- deleted old password
- substituted it with a "dummy" one built as described above
- set the option "change password at first logon"
- send the "dummy" pwd in clear to users in an email

If your users are accessing reports only through WebIntelligence you can use "Basic Authentication" to have BO check only username and protect the appl.cation through an external tool (ex. IIS security restrictions).

Hope this helps Stick to your guns

 

[pabloj]

Another chance could be to build a flat file from the active directory and use the supervisor import function, which can be used from the command line or scheduled through .bat file Stick to your guns

 

[Brooks3204]

Thanks Pabloj for the reply.

Your tip about creating a dummy password and using the encrypted version to set new users (via external program) has good possibilites for a Create New User Interface.

The main problem is when we deploy expiring passwords on all systems, Business Objects is the real problem.

It's about time that Business Objects provides us with a API or Com Interface function in their SDK to change the user's password.

I'd even be happy at the moment with a way to hook into the Change Password Dialog on BusObj.exe so I can DDE (or use the Com Interface finction IApplication.LogonAs) to logon then activate the change password (Tools, Change Password) menu option, then exit/quit.

Does anyone know how to do this?

-Brooks Vaughn
bvaughn@ftc.gov