re: Ariba Spend Management System
I would like to clarify some things.
First, I would like to apologize for any mis-representaiton due to a lack of
proper explanation on my part.
My previous post was essentially true, that the username/password is being
transmitted in clear text. However, it is not in the URL as I previously
claimed; after a closer look, it is in a post request. Either way, the fact
remains that it is still in the clear.
I tested this with the Ariba Buyer application. The Ariba Spend Management
System is a collection of applications. However, my understanding is that
most, if not all, of the applicaitons in the suite utilize the same
authentication method. Maybe somebody from Ariba can clarify this particular
issue.
For those of you who requested a sample of my packet capture, I will be sending
it shortly.
Gerald.