I just played around with it. Here are my 2 cents.
I created a new internal metadata user foo@saspw and gave it the password "foobar".
Then i extracted the metadata part with the salt and hashed password.
The salt seems to be a random string. here: p2PS
The hashed pass was: cm5vLecjDeNbyNYxTDAqsg==
Now i changed the password with the management console and wrote a little SAS skript to set back the original values:
%macro setPW(user, salt, hashed_pass);
data _null_;
length id $20
type omsUri $256;
call missing(id, type, omsUri);
omsUri = "omsobj:InternalLogin?InternalLogin[ForIdentity/Person[@Name='&user.']]";
rc=metadata_resolve(omsUri,type,id);
if rc ne 1 then do;
put "ERROR: user &user.@saspw does not exist!";
stop;
end;
rc=metadata_setattr(omsUri,"Salt","&salt.");
if rc ne 0 then put "ERROR: setting salt failed";
rc=metadata_setattr(omsUri,"PasswordHash","&hashed_pass.");
if rc ne 0 then put "ERROR: setting passwordhash failed";
run;
%mend setPW;
%setPW(foo, p2PS, %str(cm5vLecjDeNbyNYxTDAqsg==))
It was a full success. After that i was able to login as foo@saspw with the original password foobar. So the password can be set for internal accounts.
BTW: i think to see SAS metadata objects of the type InternalLogin you have to be in the role Administrator. As a standard user i was not able to see these objects.
Now comes the part how you can put all findings together.
As mentioned in my post above the default hashing algorithm is MD5, but may also be changed to SHA1. See SAS documentation.
The salt seems to be a 4 character random string with uppercase and lowercase characters and digits. You may calculate a random salt by yourself.
Now some super secret SAS algorithm kicks in to take the salt and your clear text password to create a new string which should be hashed.
The output of the MD5 hash are just some bytes. To represent it like the hash observed there must be a formatting/encoding of these bytes.
To sum it up these are the steps necessary in pseudo code:
1) md5input = secretStringOperation(salt, password);
2) hashoutput = md5(md5input);
3) hashedpassword = secretFormating(hashoutput);
To figure out the steps in 1) and 3) you can just play around with my sample data on a website like this: https://quickhash.com/
HINT: i you need more than 10 tries you are thinking to complex.
Conclusion:
The whole process could be reversed in less than an hour. So there is no security here.
Is MD5 secure? Yes and no: yes, because it cannot be reverted. So it is not possible to exactly revert the original password in clear text. And no, because there are tools out there that can. See wikipedia article: MD5 - Wikipedia, the free encyclopedia
The good part is that normal SAS users are not able to see the internal logins in the metadata. Only admins. So this should not be a security issue.
But i disagree with Jaap that SAS will be able to revert the passwords. IMHO SAS will just do the steps mentioned above and compare the hash. If the user entered the password correctly then the calculated hash should be identical to the hash in the metadata and access is granted. If the calculated hash is different from the stored hash then the password has to be wrong.
Back to the original question:
yes, it is possible to change the passwords of internal accounts in batch mode. But i would not recommend it! If you change the password e.g. of the sasadm@saspw or sastrust@saspw by accident this way your SAS platform will stop working and may be damaged beyond repair!
. I think this is typically grey area where no one outside the Dev team should have acces.
