Documentum, Java, API : Encrypt/Decrypt database password in dbpasswd.txt on DCTM server

Hello,

I would like to present a solution in order to encrypt/decrypt data base password stored in dbpasswd.txt on DCTM server via API commands and Java API programming. When and why this would be necessary ? Perhaps, if the database password has been forgotten by everybody
 
API commands
So, the password of database is stored in the dbpasswd.txt file in the docbase’s folder [DCTM_INSTALL_FOLDER]\dba\config\[DOCBASE_FOLDER]. The content of this file would be like:

 
To decrypt this value via API commands on Windows:

1. On DCTM server, launch a command and connect to targeted docbase via IAPI tool with a SUPERUSER (owner) account:
   view source

   print?

   01	D:\Documentum\product\7.2\bin>iapi mydocbase

   02	Please enter a user (hozveren): dmadmin

   03	Please enter password for dmadmin: *********

   04

   05	EMC Documentum iapi - Interactive API interface

   06	(c) Copyright EMC Corp., 1992 - 2015

   07	All rights reserved.

   08	Client Library Release 7.2.0050.0084

   09

   10	Connecting to Server using docbase mydocbase

   11	[DM_SESSION_I_SESSION_START]info: "Session 010xxxxxxxxbcde started for user dmadmin."

   12

   13	Connected to Documentum Server runing Release 7.2.0050.0214 Win64.Oracle

   14	Session id is s0

   15

   API>_

    

2. Execute the API commands initcrypto,c, and decrypttext,c,DM_ENCR_TEXT=xxxxxx:
   view source

   print?

   01	D:\Documentum\product\7.2\bin>iapi mydocbase

   02	Please enter a user (hozveren): dmadmin

   03	Please enter password for dmadmin: *********

   04

   05	EMC Documentum iapi - Interactive API interface

   06	(c) Copyright EMC Corp., 1992 - 2015

   07	All rights reserved.

   08	Client Library Release 7.2.0050.0084

   09

   10	Connecting to Server using docbase mydocbase

   11	[DM_SESSION_I_SESSION_START]info: "Session 010xxxxxxxxbcde started for user dmadmin."

   12

   13	Connected to Documentum Server runing Release 7.2.0050.0214 Win64.Oracle

   14	Session id is s0

   15	API>initcrypto,c,

   16

   ...

   17

   OK

   18	API>decrypttext,c,DM_ENCR_TEXT=Qir0/YsHIxxxxxxxxxxxxxxxxx8MGpK

   19

   ...

   20	MyDataBasePassword123

   21

   API>_

    

 
 
Java API programming

It is also possible to decrypt the password of database (stored in the dbpasswd.txt file in folder [DCTM_INSTALL_FOLDER]\dba\config\[DOCBASE_FOLDER]), via API programming. Reminder the content of this file would be like:

 
To encrypt/decrypt this value via JAVA API programming:

1. Get the file aek.key from Content Server and prepare a dfc.properties config file. The key file is available in the DCTM folder [DCTM_INSTALL_FOLDER]\dba\secure\.
    
2. Java decrypting method:
   view source

   print?

   01

   /**

   02	* Decrypting with API - longer, dm_encrypt_password passwords

   03

   *

   04	* @param passwordEncrypted

   05

   * @return

   06

   */

   07	public static String decryptWithApi(String passwordEncrypted,String AEK_PATH) {

   08	String ret = null;

   09

   try {

   10	File file = new File(AEK_PATH);

   11	if (!file.exists()) {

   12	System.out.println("Could not find aek.key file.  Please copy from Content Server to "+ AEK_PATH);

   13	return null;

   14

   }

   15

   16	System.out.print("\tAPI (decrypt) -> " + passwordEncrypted + "\t\t\t\t");

   17	com.documentum.dmcl.impl.DmclApi.getInstance().exec("initcrypto,c," + AEK_PATH);

   18	ret = com.documentum.dmcl.impl.DmclApi.getInstance().get("decrypttext,c,DM_ENCR_TEXT=" + passwordEncrypted);

   19	} catch (Exception e) {

   20	System.out.println("ERROR: " + e.getMessage());

   21

   }

   22	return ret;

   23

   }

    

3. Java encrypting method:
   view source

   print?

   01

   /**

   02	* Encrypting with API - longer, dm_encrypt_password passwords

   03

   *

   04	* @param passwordToEncrypt

   05

   * @return

   06

   */

   07	public static String encryptWithApi(String passwordToEncrypt, String AEK_PATH) {

   08	String ret = null;

   09

   try {

   10	File file = new File(AEK_PATH);

   11	if (!file.exists()) {

   12	System.out.println("Could not find aek.key file.  Please copy from Content Server to " + AEK_PATH);

   13	return null;

   14

   }

   15

   16	System.out.print("\tAPI (encrypt) -> " + passwordToEncrypt + "\t\t\t\t");

   17	com.documentum.dmcl.impl.DmclApi.getInstance().exec("initcrypto,c," + AEK_PATH);

   18	ret = com.documentum.dmcl.impl.DmclApi.getInstance().get("encryptpass,c,DM_ENCR_TEXT=" + passwordToEncrypt);

   19	} catch (Exception e) {

   20	System.out.println("ERROR: " + e.getMessage());

   21

   }

   22	return ret;

   23

   }

    

4. Test decrypting and encrypting method via Java API commands:
   view source

   print?

   01	// --------------------------------- Encrypting/Decrypting with API

   02	String aekkeyfile = "T:/Public/HUO/aek.key";

   03	password = "DM_ENCR_TEXT=Qir0/YsHIxxxxxxxxxxxxxxxxx8MGpK";

   04	// try decrypting with API - longer, dm_encrypt_password passwords

   05	System.out.println("\nTrying to decrypt '" + password + "'...\n");

   06	clearText = decryptWithApi(password, aekkeyfile);

   07	if ((clearText != null) && (clearText.length() > 0)) {

   08	System.out.println("'" + clearText + "'");

   09

   }else{

   10	System.exit(1);

   11

   }

   12

   13	clearText = "TEST-javablog-Documentum@123";

   14

   15	// try encrypting with API - longer, dm_encrypt_password passwords

   16	System.out.println("\nTrying to encrypt '" + clearText + "'...\n");

   17	password = encryptWithApi(clearText, aekkeyfile);

   18	if ((password != null) && (password.length() > 0)) {

   19	System.out.println("'" + password + "'");

   20

   }else{

   21	System.exit(1);

   22

   }

   23

   24	// try decrypting with API - longer, dm_encrypt_password passwords

   25	System.out.println("\nTrying to decrypt again '" + password + "'...\n");

   26	clearText = decryptWithApi(password, aekkeyfile);

   27	if ((clearText != null) && (clearText.length() > 0)) {

   28	System.out.println("'" + clearText + "'");

   29

   }else{

   30	System.exit(1);

   31

   }

    

That’s all!!!

Huseyin OZVEREN