Change Epicor Password using REST services

[erzt23 (Eduardo)]

Hi Everyone

Epicor version: E10 10.2.300.11

I am doing a web portal that is using EPICOR REST services, one of the task for this Web portal is to be able to change the password of my Epicor Account, so then, I am trying to use the following services Custom methods, Ice.BO.User.FileSvc / ChangePassword, this method request 3 parameters

• userId
• currentPassword
• newPassword

currentPassword and newPassword require to be encrypted, my question is…

Do you know what kind of encryption Epicor require?

I tried to use some examples from the following link

Additional Password Validation

We currently have a customer requirement to implement additional password security within all of our applications (including Epicor). Most of the requirements we were able to handle using the Password Policy and core functionality in Epicor 10.1.500.14 (i.e. at least one uppercase/lowercase/number, force password change every 3 months, lock account after X failed logins). However, there is one requirement we’re currently struggling with: “Account passwords must be configured with a history file …

but I am not able to make it work, in the other hand the link above suggest to use the following dll, Epicor.System.dll by using the following code

// Returns: 46uIY6/nQjHL5mX1KeE/7NtEXD3MIOblGxpVRH5ZWXNORGsNwT3WHg== for example. Epicor.Security.Cryptography.SHA.Hasher.ComputeHash(“manager”);

Using the same dll, the code above is not available in 10.2.300, this is the code available

Epicor.Security.Cryptography.X509.Encryptor.ComputeHashToBase64String

I tried to use it and it is not working…

Do you have any ideas?

Thanks for your help

[josecgomez]

Use a UBAQ and call the BO from the UBAQ
Then you can use all the internal functions including the generator of password hash

[Mark_Wonsil]

I agree with @josecgomez but for understanding, see Haso’s Post.

[ Technical ] Epicor Password Hash - SHA256

From a high-level Epicor has a little helper class to hash the password via 2 helper methods ComputeHash, VerifyHash it does support different algorithm’s such as SHA1, SHA256, SHA384, SHA512, MD5 but by default Epicor uses SHA256. That helper lies in Epicor.System.dll usually stored in the bin folder on the IIS App Server. High Level ComputeHash: Using RNGCryptoServiceProvider creates a random number salt as bytes Converts your plain-text password string into bytes Creates a buffer with th…

[erzt23 (Eduardo)]

Thanks… I will do.
however, Do you know the dll that I should use to encrypt
I am trying to use Ice.Lib.Cryptography.dll

[Mark_Wonsil]

I fixed the link. Haso was using these:

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Security.Cryptography;

[tkoch (Theodore Koch)]

@erzt23 did you get this working? I also have a need for this and trying to call UserFileSvc.ChangePassword but it is not accepting the byte array I am computing for the current and new password.

This is the error I am getting

See more info in the Inner Exception section of Exception Details. ---> System.Security.Cryptography.CryptographicException: Error occurred while decoding OAEP padding.