Password Encryption Using Encrypt.bat

nvalia · Post by **nvalia** » Wed Apr 24, 2013 12:23 pm

Hi All,

Datastage 8.7 on Windows 2008 R2

I am successfully able to run a job from a script using the dsjob command and hard coding the userid and password, along with other required parameters for this command. (So this means my domain used in the command is correct).

Now I tried to use an Encrypted UserID and Password with the dsjob command and it fails giving a Domain Login error - 1010 dsje_domainlogtofailed

I encrypted the password (say "test") using this command,
C:\IBM\InformationServer\ASBNode\bin\encrypt.bat test and it returns "{iisenc}xvybkFWZNPlfJmdZa3WpMQ=="..
then I used this value instead of the actual password (test) in the dsjob command and it fails..(Similarly I encrypted the userid as well)

Is it necessary to encrypt both Userid and Password, or we can only do for the password?

Has Anyone been able to use this Encryption successfully or has seen this error?

Thanks in advance,
NV

ray.wurlod · Post by **ray.wurlod** » Wed Apr 24, 2013 3:58 pm

You can encrypt any string you like. I typically only encrypt passwords. While I have not used it with dsjob, I have used it successfully with other commands including istool and importexportmanager.

nvalia · Post by **nvalia** » Wed Apr 24, 2013 8:52 pm

Since it does not seem to work with dsjob command, how else can we have a encrypted password work with dsjob
(we do not have any third party encryption tool/utility)

ray.wurlod · Post by **ray.wurlod** » Wed Apr 24, 2013 10:46 pm

Can dsjob use an authorisation file? (I'm not currently in a position to check.)

chulett · Post by **chulett** » Thu Apr 25, 2013 6:52 am

You can reference a file that holds server, userid and password (from what I recall) and if that's what you mean by an authorization file then yes! Never tried an encrypted password there.

nvalia · Post by **nvalia** » Thu Apr 25, 2013 7:34 am

But even if I call this Credentials file the password would still not be encrypted right..It is still visible in this file

chulett · Post by **chulett** » Thu Apr 25, 2013 7:37 am

I don't know if you can use an encrypted password in that file. That would be either a "try and see" thing or an "ask support" thing. We didn't worry about it being "visible" in the file, we made sure access to the file was locked down enough to satisfy our security folks.

nvalia · Post by **nvalia** » Thu Apr 25, 2013 8:07 am

Thanks..
I was also thinking of that as the last option..Securing the credentials file!

nvalia · Post by **nvalia** » Thu Apr 25, 2013 12:36 pm

I created a Credentials File and it has values for all 4 components, Order in the file does not matter

# Datastage credentials
domain=<Servername>:9080
server=<servername>
user=<username>
password={iisenc}ELpGU5b/cE8a6db8yIqw8Q==

** NOTE:password is encrypted using this command
C:\IBM\InformationServer\ASBNode\bin\encrypt.bat <password>
OR
C:\IBM\InformationServer\ASBServer\bin\encrypt.bat <password>

Then I am calling the dsjob as below with relevant options

dsjob -authfile $DIR/DS_Cred_File.txt -run ... <prjname> <jobname>
** NOTE:We need to provide the full path of the Credentials file

This way I am able to use the encrypted password with the dsjob command successfully!