PassAid Custom Pre-Connection Programs

Generally, PassAid will make connections to all selected databases with the same user ID and password and change the password to the same new value. Sometimes, passwords and/or user IDs in your databases are not the same, but they follow a certain pattern or you want new passwords to be different from each other but follow a pattern. If you are content with certain vulnerabilty of passwords following patterns, and you can write a program that, given a database's net service name and a common user ID and password, will produce a user ID, a current password and a new password for that database, then PassAid can be configured to invoke your custom program before connecting to each database. The only function and purpose of such custom program is to produce a login ID and/or current and new password to be used for connection to the next database.

Normally, a custom pre-connection program will only perform some more or less simple string manipulations to produce the required values; however, it can use any other means, like accessing other documents or databases where passwords are stored.

A custom program can be a batch file, a Visual Basic script, a Java class, etc. It will be called by and executed in PassAid session environment, therefore it cannot be a 32-bit GUI application. You have to provide the exact command when configuring PassAid. The command is a call to your custom program (a fully qualified executable file name), optionally followed by parameters. PassAid will execute the command before connecting to each of the selected databases. PassAid will check the command's exit code and will only connect to the next database the exit code was 0. When the custom program is called, PassAid is not connected to any database.

A common user ID is always part of PassAid configuration. When you direct PassAid to change passwords, even when using a custom program, you are still required to enter a common password. Values of these common user ID and password, along with the net service name of the database to which the next connection will be made, are available to the custom program through environmental variables x_loginid, x_old_pwd, and service_name. Value of x_old_pwd is already enclosed in double quotes.

The goal of the custom program is to produce correct values for any or all of the following parameters to be used when connecting to the next database: the user ID, the current password, and the new password. To make the new values visible to PassAid, the custom program must assign them to variables x_loginid , x_old_pwd, and x_new_pwd respectively, by writing the assignments to a temporary file whose name is stored in environmental variable TMPFILE2, in a form <variable>=<value>. Again, the values of x_old_pwd and x_new_pwd must be enclosed in double quotes. PassAid will read the file and will only take into account new values for x_loginid, x_old_pwd, and x_new_pwd and use them on the next database.

Suppose, in a set of QA databases whose service names begin with a letter Q, the user ID that you want to use for connection is the same for all databases, the current password in each database is a concatenation of the user ID, a dollar sign $, and the last three characters of the database service name, and the new password should be a concatenation of the first four characters of the user ID, an underscore _ and the database service name. A custom program that produces a user ID and passwords for each database (in a form of Windows XP batch file) may look like this:

REM PwdGenQA.bat

REM Based on the common user ID, common password, and the next
REM next database's net service name available as,
REM respectively,%x_loginid%, %x_old_pwd%, and
REM %service_name%, produce new values for x_old_pwd and
REM x_new_pwd and write them to file%tmpfile2% in a format
REM <variable>=<value>.

REM Verify if we are dealing with the right database.
REM Check if database name begins with Q; if not, exit with a
REM non-zero exit code to have PassAid bypass connection to
REM this database; use /b option to exit just from this batch
REM file but not from the entire PassAid program
IF /I NOT "%x_loginid:~0,1%"=="Q" EXIT /B 1

REM Now, generate the current password according to the
REM pattern. Enclose password value in double quotes
SET x_old_pwd="%x_loginid%$%service_name:~-3%"

REM Now, calculate the new password according to the pattern.
REM Enclose password value in double quotes
SET x_new_pwd="%x_loginid:~0,4%_%service_name%"

REM Write the values to file %TMPFILE2%
REM First, clean up the output file
ECHO.>%TMPFILE2%
REM ECHO command can be used (be careful though - special
REM characters in passwords may have undesirable effect):
REM ECHO x_old_pwd=%x_old_pwd%>>%TMPFILE2%
REM ECHO x_new_pwd=%x_new_pwd%>>%TMPFILE2%

REM Here is a better way to store a variable's value in a
REM file: SET command without the equal sign "=" can be used
REM - it will work regardless of any special characters
REM in the password
SET x_old_pwd > %TMPFILE2%
SET x_new_pwd >>%TMPFILE2%
SET x_loginid >>%TMPFILE2%
REM The above three lines can be literally used in your batch
REM file. Note that the last command above is not really
REM necessary in our case since login ID is not being changed.

REM Make sure the program exits with 0; use /b option to exit
REM just from this batch file but not from the entire PassAid
REM program:
EXIT /B 0

Assuming this program is located in c:\my_programs\PassAid directory, your PassAid custom command that uses this program should be
c:\my_programs\PassAid\pwdgenQA.bat

Carefully debug your custom program before using in with PassAid.

main help page