Log in to AnswerLog in to Follow
2021-11-29 08-42-47
Johan Åström
16Views
4Comments
Solved
[IdP] What password is stored on automatic user provisioning?
Question
Forge
Traditional Web
idp
Web icon
IdP
Forge component by Rui Barbosa
Application Type
Traditional Web

I'm using the IdP module with Azure AD as Identity Provider. 

When users are auto-provisioned, what password is stored in Outsystems?
I can tell from the System/Users table that something is stored, but it's not the Microsoft password, as I can't use this to sign in to other Outsystems apps.

Judging from the code in the IdP module, it would seem as though nothing is stored, since the Passsword attribute is never given a value:

So, is it some kind of default password?

0
0
14 Mar
2020-10-08 19-51-35
João Barata
Staff
Solution

Replying to Johan Åström's comment on 14 Mar 2022 12:28:39

Hi @Johan Åström,

As you were able to check on the code, when the user is created, the password is not set for the user. In fact, the IdP component is not able to get the user password since the password is only entered on the login page of the external Identity Provider.

What I suspect might have happened in your example is that the user that you are authenticating with the IdP component already existed. In that case, only the name, email but not the password are updated.
If the user already had a password set, it will still be there on the password field with the platform salted hash.

Regards,

See solution in context
0
0
14 Mar
2019-12-18 10-16-29
Fábio Fantato
mvp_badge
MVP

Hi Johan,

The User entities in Systems is shared by OutSystems or External Users from the other SSO.

If it is an OutSystems User the password attribute is set and is always encrypted. But when we are using external SSO, the users are only a bind for the real users stored in the external system.

So, in this case, no password will be stored on the OutSystems side, only in the SSO. It is the responsibility of the SSO provider you are using to do the proper authentication and when we receive the callback in OutSystems we do the login directly without the need to know the password.


best regards

Fabio




0
0
14 Mar

I see, however, when users are auto-provisioned by the IdP, I can see a hashed string in the password attribute of the created user in the Users table, so a password is clearly generated and stored.

The reason I need to know this is because I want the users of the organization I'm working with to be able to authenticate with basic auth to e.g. REST API:s that I'm exposing in the application using their Microsoft credentials; this authentication has to be done with an Outsystems user, and therefore I would like the provisioned OS user to mirror the AD user in both Username and Password.


0
0
14 Mar
2020-10-08 19-51-35
João Barata
Staff
Solution

Replying to Johan Åström's comment on 14 Mar 2022 12:28:39

Hi @Johan Åström,

As you were able to check on the code, when the user is created, the password is not set for the user. In fact, the IdP component is not able to get the user password since the password is only entered on the login page of the external Identity Provider.

What I suspect might have happened in your example is that the user that you are authenticating with the IdP component already existed. In that case, only the name, email but not the password are updated.
If the user already had a password set, it will still be there on the password field with the platform salted hash.

Regards,

0
0
14 Mar

Replying to João Barata's comment on 14 Mar 2022 15:34:31

You're spot on - upon investigating, it turns out somebody had manually created a password for the provisioned user.

Thank you for your input!

0
0
15 Mar
Community GuidelinesBe kind and respectful, give credit to the original source of content, and search for duplicates before posting.