Encrypt Password and User values that come from a cube

[AnonimusMax]

Hi!
I have a parameters cube, the cube structure is: Month dimension, Year Dimension, Parameters Dimension, Entityes Dimension
In this cube we store the user and the password used in TI processes that load data from Oracle( DB User and Password).
Is there a way that when you open the cube to not see the password in clear (I want it to be encrypted)?
But when all the processes are executed...the password has to be decrypted ( we obtain the password and the user with CellGetS used in the TI process).

Thank you

[Wim Gielis]

Isn't that the whole purpose of security ?

[tomok]

Who are you trying to hide the information from? Users? If that's the case then just don't give any users READ or WRITE access to the cube. If it is everyone then it is not possible as Admins will still be able to see what's in the cube. What you can do is store the Oracle ID and password in a text file and store that file in a share that has restricted access. Then you just have a wrapper process that opens the Oracle ID file and reads the ID and password, assigns them to a parameter, and then calls whatever process that needs them. You can use this same wrapper process to get the Oracle ID and password for all of your Oracle-related TI processes.

[AnonimusMax]

Thank you for your replay.

But isn t there a way to encrypt the value from that cell, that when a user opens the cube to not be able to read that information?
I think if you look inside the control cube }ClientProperties , you ll find a field Password witch I think it is encrypted.
I was trying to do the same for my DB pass and user. Is it possible?

Thank you

[tomok]

But isn t there a way to encrypt the value from that cell, that when a user opens the cube to not be able to read that information?

No, not as part of TM1. You could encrypt it yourself before storing in the cube but then you'd have to put a routine in your TI to unencrypt whenever using. You might be able to write an unencrypt function in Java and call that from your TI.

[AnonimusMax]

Thank you for your suggestion! Do you have an example of how to use this java function?

I was thinking of another solution, but I do not know if this is a good one and I wanted to share this idea with you.
In the measure dimension I store the password using a string element. Do you know if there is a custom format to apply for this string element? I was thinking to apply a format that when I open the cube, the cell where I store the password to be blank due to the custom format that is applied, but when the TI reads the value stored, it should read the correct password.

For example...I store the following password: 12$34fTb!
When I open the cube, this value will not be shown even if it has a values, but when TI reads the value , reads not blank spaces, but the real password (12$34fTb!)

[qml]

I was thinking of another solution, but I do not know if this is a good one and I wanted to share this idea with you.
In the measure dimension I store the password using a string element. Do you know if there is a custom format to apply for this string element? I was thinking to apply a format that when I open the cube, the cell where I store the password to be blank due to the custom format that is applied, but when the TI reads the value stored, it should read the correct password.

It is possible to do that. A custom format of '!' will display a string as empty. This, however, is a classic example of security through obscurity. Anyone with read access will still be able to copy the seemingly-but-not-really-empty value and paste it elsewhere or just slice it to Excel.

Which brings us back to tomok's all-important question: who are you trying to hide the Oracle password from? Once you answer that question we will be able to suggest an appropriate solution.

[AnonimusMax]

Hi,

Thank you very much. This worked. I was trying to hide it from admins.
I was trying in parallel with Java, but if i manage to make it work with JAVA it means that i have to change all the TIs that are using ODBC, because in those processes i get my password and user with CellGetS.

[qml]

You've now 'protected' the password from admins in a way I can only liken to closing one's eyes in order to make things invisible.

Check out this thread for other ideas on how to do it better. Especially Brian and Paul made some good suggestions.

[AnonimusMax]

Ok, i will check

Thank you