09-02-23 12:55 AM
I'd imagine to use something commonly used by software, but I haven't found any documentation that tells me what algorithm Blue Prism uses to hash user passwords. Could any one please tell me which document comments it?
09-02-23 06:59 AM
Hi Bohyon,
I always assumed it would use the data in System >> Security to do the hashing. But I could be wrong as nor I have seen any documents pointing that way.
If you are on the System >> Security tab, you could press the question mark in the upper right corner for BP's help text, and then choose Show Help Topic, you'll get whatever was written on this subject in the BP product.
09-02-23 07:38 AM
Thank you for your kind response.
The help function marked with a question mark directs me to "Manage users" page:
https://bpdocs.blueprism.com/bp-7-1/en-us/helpSystemManUsers.htm
The following information can be found there.
"The options available on the screen depend on the authentication method configured for your Blue Prism environment, and the account type configured for a specific user. For more information, see Authentication in Blue Prism."
Visiting "Authentication in Blue Prism" page at
https://bpdocs.blueprism.com/bp-7-1/en-us/frmLogin.htm,
I also found this sentence,
"By default, Blue Prism uses its own authentication mechanism." in Blue Prism native authentication section.
I tracked down that there might be some documentation like this, "Blue Prism uses SHA256 instead of MD5 for user account management."
We know that Blue Prism provide that we could choose one of data encryption algorithm among AES-256 ACS, AES-256 RM and Triple-DES. Similarly, I'm hoping that a method for a hash algorithm is also commented in the documentation.
My efforts are part of the company's efforts to get Blue Prism through the GS Certification Program. I am sorry that it may not be very practical.
PS. Recently, BPK is trying to certify Blue Prism as the Good Software, which is an important program supported by the Korean government. GS certification requires full documentation of all actions users can perform using the software.
09-02-23 09:51 AM
Hi again,
I assume referring to the standards used would suffice in most cases.
If the documentation would need to be completed to comply with named Korean certification, I would hope for BP to jump right on it and help you out to fix any suspected misses that would delay this project. I reckon that if you rename this thread to 'Certification of BP product for marketing in Korea' or similar, it would grab the attention of the good folks at BP immediately. Otherwise I'd suggest contacting one of the BP community moderators, or BP support directly.
10-02-23 01:59 AM
Good! Thank you so much.