topic Re: Update internal password with a stored process in Administration and Deployment

Update internal password with a stored process

Cedric_HANQUEZ — Sat, 08 Jun 2024 07:55:57 GMT

Hi,

I have a large set of users (internal users @saspw) and I'd like to give them the chance to change their internal password by themselves.

They have an access to the stored process web app, and only that application.

I am thinking of a Stored Process that they could use to change this password.

Has someone already created such stored process?

Thanks

Cédric

Re: Update internal password with a stored process

Quentin — Sat, 08 Jun 2024 14:32:53 GMT

I'm not an admin or a security guy, but this seems risky. If you write a stored process to hand-roll the process of updating passwords, you could easily end up with passwords ending up in clear text log files, etc.

I assumed most servers were set up to integrate with an independent, dedicated account/password management system (e.g. active directory on Windows), where I would assume any processes for updating passwords would be secure by design.

(Oh, I just googled. The definition of these internal accounts (@saspw) is that they exist only in metadata, not in an external authentication domain. So I can how if you've got a lot of these, you would want some automated way for users to be able to maintain them. yikes. Assuming these users only have read access to reports that aren't sensitive, maybe the benefits of having an automated stored process to allow users to manage their passwords are worth the security risks.)

Re: Update internal password with a stored process

SASKiwi — Mon, 10 Jun 2024 06:10:16 GMT

There's a large learning curve to doing this if you haven't played with SAS metadata before. You will need to become familiar with the DATA step metadata functions. then learn how to navigate the metadata object model. I find it easiest to use the metadata browser (METABROWSE) that is available in the SAS Windowing Environment. Please note that writing to the SAS metadata repository is risky and can easily end up corrupting it. You could investigate the Active Directory metadata synching process to gain a better understanding of updating.