jmcpeek's avatar
jmcpeek
Contributor
5 years ago
Status:
New Idea

SessionCreator - improve password security

From its description, we believe SessionCreator could solve several of the problems we've encountered by letting us run a truly headless session, but password security is preventing us from being able to use it. The user account(s) running our tests have access to highly-regulated data and we simply cannot pass the authentication details it in the command line or store it in plain text in a file.

 

Please add support for encrypted passwords, re-using an existing session based on a key of some kind, or some other method so we do not have to have passwords visible in plain text.

7 Comments

Sort By
  • LinoTadros's avatar
    LinoTadros
    Community Hero
    5 years ago

    You can use the DotNet system to encrypt and decrypt passwords in TestComplete using the built in framework assembly System.Text

    The way to do that is to use dotNET.System_Text.xxxxxx and use the encryption algorithem of your choice.

     

    You can also use something like the Azure KeyVault and keep all your encrypted passwords there and retrieve them with an API call during the execution of the test without every having access to the passwords in the test.

     

    Cheers

    Lino

  • tristaanogre's avatar
    tristaanogre
    Esteemed Contributor
    5 years ago

    While LinoTadros is correct in what he's mentioning concerning encrypted passwords, in this case, unfortunately, I'm not sure it applies.  The SessionCreator tool that ships with TC is a commandline uitlity with a password command line switch that, at this time, is not encrypted.

  • jmcpeek's avatar
    jmcpeek
    Contributor
    5 years ago

    tristaanogre - that's exactly what I was about to say. The suggestions are appreciated, but look like they're downstream from where we need the passwords to be protected.

  • LinoTadros's avatar
    LinoTadros
    Community Hero
    5 years ago

    Sorry about that, I missed the "SessionCreator" part.

    My apology

    -Lino

  • Bobik's avatar
    Bobik
    Frequent Contributor
    5 years ago

    CI systems like Jenkins can encrypt passwords and save it securely. So if you use SessionCreator with CI system your password could be hidden.

  • jmcpeek's avatar
    jmcpeek
    Contributor
    5 years ago

    Bobik - we have a homegrown command line tool that we use for kicking off the tests. We have jenkins and use it in some cases, but we'd get the most value from being able to run them from the command line.