XI/PI: Secure Storage Service with User Defined Funtions

[MichalKrawczyk]

Can/should you store passwords in user defined functions ? (for example for JCO calls).
You should never do that, why:

1) because you will need to change the pass when your landscape will change (from DEV to QAT to PRD)

2) because everyone who will be able to open your mapping will be able to see the password if you store it in plain text

3) because you may need to change the password from time to time

So is there any alternative ? Maybe a standard one?
Secure Storage Service is one of the possibilities. It's a place where you can put your passwords.

Step 1

Import necessary libraries as External Archives into your Integration Repository:

tc_sec_securestorage_service.jar
which can be found in: \j2ee\cluster\server0\bin\services\tc~sec~securestorage~service

and

frame.jar
which can be found in: \j2ee\cluster\server0\bin\system

Step 2

Create a user defined funtion in your Message Mapping with the code as shown below:

String myObjectRet = new String(); Object o;  try { javax.naming.Context ctx = new javax.naming.InitialContext(); o = (Object) ctx.lookup("tc~sec~securestorage~service");  SecureStorageRuntimeInterface secStore = (SecureStorageRuntimeInterface) o; //Continue with implementation      RemoteSecureStorageClientContextInterface myContext = secStore.getSecureStorageClientContext();      //Store an object//remove the comment below below if you want to Store an object (this is only for blog purposes - you should't set the pass in the same UDF - you should only restore it in UDF //myContext.storeObject(new String("myPassword"), "pass");       //Retrieve an object String myObject = (String) myContext.retrieveObject("pass"); myObjectRet = myObject;     } catch (RemoteException e1) { // TODO Auto-generated catch block // e1.printStackTrace();//remove the comment below below if you want to Store an object // } catch (ObjectStorageException e1) { // TODO Auto-generated catch block } catch (ObjectRetrievalException e1) { // TODO Auto-generated catch block } catch (NamingException e1) { // TODO Auto-generated catch block   }return myObjectRet;

Make sure you will those libraries into import section of your UDF:
com.sap.security.core.server.securestorage.*;javax.naming.*;com.sap.engine.frame.state.*;
java.rmi.*;com.sap.security.core.server.securestorage.remote.*;com.sap.security.core.server.securestorage.exception.*;

If you create the object in Secure Storage you will see it it there directly after creation:



Step 3

And when you execute your function you will that the value was successfuly restored.