Password attribute in a concatenated string stays encrypted

ddumas

In an email notification, I place the following in the message of the email:

Code:

...Your login is: ' + Vendor.LoginName + ', and your password is: ' + Vendor.Password

In the email, it produces:

Your login is: v3, and your password is: @@BAS_PASSWORD@@

The password id not @@BAS_PASSWORD@@

Is there some function to convert it to the plain text value?

Dave

rocketman

No - and this is deliberate AIM policy. There are many posts on the subject. If you want your users to be able to retrieve forgotten passwords, you will have to alter your enter new process to store the password in a plain text attribute and then put it into the password field wit a rule

something like IF Vendor IS NEW then Vendor.password=Vendor.somesillynamesono_onecanguesswhatitis

When you want to issue the password in an email, use the plain text version

This is not recommended practice BTW.

ACDC

One of the ways to issue passwords is to check for a "reset" password flag on every login. If the flag is set to yes then prompt the user to create a new password.

This way, the user can be sent a "known" text password in an email and when the user logs in for the first time (and the flag is set to yes) the user is forced to create a new password with the process setting the reset flag to no.

Forgotten password can be handled the same way, just reset the flag to yes

In my mind this seems to be the most secure way of issuing a password, it also ensures the user is the only one that knows th password

ddumas

ACDC wrote
One of the ways to issue passwords is to check for a "reset" password flag on every login. If the flag is set to yes then prompt the user to create a new password.

This way, the user can be sent a "known" text password in an email and when the user logs in for the first time (and the flag is set to yes) the user is forced to create a new password with the process setting the reset flag to no.

Forgotten password can be handled the same way, just reset the flag to yes

In my mind this seems to be the most secure way of issuing a password, it also ensures the user is the only one that knows th password

I that that. I am still in development mode, so I need to read up on the documentation for best practice for setting up user login page / change password, etc.

Dave

ddumas

rocketman wrote
No - and this is deliberate AIM policy. There are many posts on the subject. If you want your users to be able to retrieve forgotten passwords, you will have to alter your enter new process to store the password in a plain text attribute and then put it into the password field wit a rule

something like IF Vendor IS NEW then Vendor.password=Vendor.somesillynamesono_onecanguesswhatitis

When you want to issue the password in an email, use the plain text version

This is not recommended practice BTW.

Thanks - saw those posts. I added a new column for Vendor.ClearPassword. I created a process called form a menu item, that does:

ENTER New Vendor
Vendor.Password = Vendor.ClearPassword

That worked and I send the ClearPassword in the email.

That said, I need to understand best practice for how to setup a proper login / change password screen, that also takes this new ClearPassword column into account.