OIM 11g R1: Getting OIM User Decrypted Password

Version: Oracle Identity Manager 11g R1
Description: If you look at the OIM.USR table, you'll notice that the password column is encrypted. There are several ways to get the password decrypted. I'll be showing you how to get the decrypted password by querying from the OIM database using the tcDataBaseClient. This requires you to set the client handle with the OIMClient object. The user who is logged in for the OIMClient needs to be an End-User Administrator in order to use the tcDatabaseClient. The “Design Console Access” attribute on the OIM User Profile determines whether a user is an End-User or an End-User Administrator. Below is a java application to get all the OIM users' passwords in plain text.  Note: You can also query the OIM.PCQ table to get users' challenge questions and answers.

import Thor.API.Security.XLClientSecurityAssociation;
import com.thortech.xl.dataaccess.tcDataBaseClient;
import com.thortech.xl.dataaccess.tcDataProvider;
import com.thortech.xl.dataaccess.tcDataSet;
import com.thortech.xl.dataaccess.tcDataSetException;
import java.util.Hashtable;
import java.util.logging.Level;
import java.util.logging.Logger;
import javax.security.auth.login.LoginException;
import oracle.iam.platform.OIMClient;

/**
 * This class gets the OIM Client and uses that to establish a
 * connection to the OIM Schema. You can query the USR table and
 * get the password in plain text. 
 * NOTE: The administrator credential must be used for the OIM Client. 
 */
public class DecryptedOIMPassword 
{
    public static void main(String[] args)
    {
        tcDataProvider dbProvider = null;
        OIMClient oimClient = null;

        try 
        {
            String ctxFactory = "weblogic.jndi.WLInitialContextFactory"; //WebLogic Context 
            String oimServerURL = "t3://localhost:14000"; //OIM URL
            String authwlConfigPath = "resources/config/authwl.conf"; //Path to login configuration
            String username = "xelsysadm"; //OIM Administrator 
            String password = "Password1"; //Administrator Password

            System.setProperty("java.security.auth.login.config", authwlConfigPath); //set the login configuration
            Hashtable<string,string> env = new Hashtable<string,string>(); //use to store OIM environment properties
            env.put(OIMClient.JAVA_NAMING_FACTORY_INITIAL, ctxFactory);
            env.put(OIMClient.JAVA_NAMING_PROVIDER_URL, oimServerURL);
            oimClient = new OIMClient(env);
            oimClient.login(username, password.toCharArray()); //login to OIM

            XLClientSecurityAssociation.setClientHandle(oimClient);//Needed for database client
            dbProvider = new tcDataBaseClient(); //Connection to OIM Schema
            tcDataSet dataSet = new tcDataSet(); //Stores the result set of an executed query
            String query = "SELECT * FROM USR"; //Query Users table
            //String query = "SELECT * FROM PCQ"; //Query Users Challenge Question
            dataSet.setQuery(dbProvider, query); //Set query and database provider
            dataSet.executeQuery(); //execute query and store results into dataSet object
            int records = dataSet.getTotalRowCount(); //Get total records from result set

            for(int i = 0; i < records; i++)
            {
                dataSet.goToRow(i); //move pointer to next record
                String plainTextPassword = dataSet.getString("USR_PASSWORD");
                String userLogin = dataSet.getString("USR_LOGIN");
                String userStatus = dataSet.getString("USR_STATUS");
                System.out.printf("User Login: %s\nStatus: %s\nPassword: %s\n\n", userLogin, userStatus, plainTextPassword);  

                //Getting user challenge questions and answers
                //String usrKey = dataSet.getString("USR_KEY");
                //String question = dataSet.getString("PCQ_QUESTION");
                //String answer = dataSet.getString("PCQ_ANSWER");
                //System.out.printf("USR_KEY: %s\nQuestion: %s\nAnswer: %s\n", usrKey, question, answer);
            }
        } 

        catch (tcDataSetException ex) 
        { 
            Logger.getLogger(DecryptedOIMPassword.class.getName()).log(Level.SEVERE, null, ex);
        }

        catch (LoginException ex) 
        {
            Logger.getLogger(DecryptedOIMPassword.class.getName()).log(Level.SEVERE, null, ex);
        }

        finally
        {
            //close connections
            try{dbProvider.close();} catch(Exception e){}
            try{XLClientSecurityAssociation.clearThreadLoginSession();} catch(Exception e){}
            try{oimClient.logout();} catch(Exception e) {}
        }     
    }//end main method   
}//end class