Encrypt all credentials

Parameters in configuration files for credentials must not be stored in clear text for security reasons. The same applies to the location in the database to store credentials for external applications that Service Manager integrates with.

Credentials stored in configuration files

Service Manager encrypts credentials in configuration files stored in the file system automatically using a randomly generated master key. For more information, see Randomly generated master keys.

The Service Manager administrator must be familiar with this concept, and the risk of making the system inaccessible by accident. The administrator needs to know how to make Service Manager recreate the master key, and the importance to take precautions and store credentials at a safe place. See also Document credentials in a safe place.

Credentials stored in dbdicts

Credentials of external applications that Service Manager integrates with are stored in the RDBMS. Examples include Service Manager Integration Suite (SMIS) integrations, or integrations implemented in JavaScript (both based on web services or REST).

Credentials of external applications used by Service Manager are stored in the database, and transmitted in HTTP message headers. The passwords are required to be protected in both.

Passwords for external applications using SMIS are stored as encrypted in the database. In the wizard to set up an integration instance, these parameters appear on the Secure parameters tab.

When implementing a web service or RESTful integration directly, the implementer is responsible for storing the credentials securely. When using the RunWSDL2JS wizard to produce JavaScript code to interface with an external application, the credentials get stored as plain text in the generated ScriptLibrary record.

The transmission of credentials in HTTP messages is also not secure: The Authorization header property is not securely encrypted. Secure transmissions require TSL/SSL configuration.

Related topics

Service Manager maintenance tasks

Configuration tasks

Randomly generated master keys

Document credentials in a safe place