Admin user's password is shown in clear text in JawsProperties table

Products

• Automation Analytics & Intelligence

Issue/Introduction

After changing the default password for the admin user in AAI, the new password appears in clear text within the JawsProperties database table. Specifically, the value is visible in the STRVALUE column where the PROPERTYNAME is set to servicePass.

Environment

Product: Automation Analytics & Intelligence (AAI) 

Version: 24.x and earlier

Cause

The servicePass parameter is utilized by the AAI backend API to allow internal microservices to authenticate and connect to the AAI API using the admin user credentials. In current versions of AAI, the code expects this parameter to be in clear text; consequently, providing an encrypted value prevents these services from connecting correctly.

Resolution

This behavior has been identified as a product limitation and is being addressed under defect DE178970.

A code change to support the encryption of this parameter has been confirmed as accepted for release in AAI version 26.0.