Which field for logon-authentication ??

, ,
1

Imported from previous forum

2

In order to use the logon message for authentication the initiator has to supply username and password (to be encrypted in a later stage).

  1. Which FIELD is should contain logon data (username, pw) (the RawData field) ?

  2. How can they be encrypted, if the encryption key is supplied only in the server’s confirmation logon message (AFTER the logon message).

Thanks for answering,

P.Class
cin/technology

3

[ original email was from Jim Northey - jnorthey@lasalletech.com ]
1. There is not currently a set way to provide a login and password. A couple of approaches have been taken by implementors. At CBOE we embed the login and password in the SenderSubID. Another implementation uses a user defined tag 9600 for the password - using the SenderCompID as the login. I don’t believe we have come up with a standard recommendation on how to implement an additional login/password at this time.

  1. Regarding the question on encryption - refer to the standard header section in the specification - it indicates that the header fields, such as SenderSubID can be included in the encrypted section. This implies you are using an encryption mechanism outlined as part of the FIX standard.

> In order to use the logon message for authentication the initiator has to supply username and password (to be encrypted in a later stage).
>
> 1. Which FIELD is should contain logon data (username, pw) (the RawData field) ?
>
> 2. How can they be encrypted, if the encryption key is supplied only in the server’s confirmation logon message (AFTER the logon message).
>
> Thanks for answering,
>
> P.Class
> cin/technology
>