Cristinel Anastasoaie

Important Security Policy Updates - Effective December 14th

Updated - Friday, 25 November: to reduce the amount of work required to update existing websites, we are keeping the {tag_recipientpassword} functional until our January release. All the other changes will be released as planned on December 14th.

Effective December 14th 2011 we will be updating the way we handle CRM user passwords, for security reasons. In order to achieve a greater level of security, we are going to update some of our Admin Console user interfaces and CRM APIs. Existing customer reports will also be altered during the update.

Below is a list of user interfaces and APIs impacted by the change:

  • BC Admin > Customers > Customers > View customer details: CRM user password will be obfuscated
  • BC Admin > Customers > Customers > Edit customer details: CRM user password will be obfuscated; site admin or partner will still be able to update the password
  • BC Admin > Reports > Customer Reports > New Customer Report > Step 2 - Select fields: Password field will be removed from the list of available fields, making the password field unavailable in Customer Reports
  • BC Admin > Reports > Customer Reports > Saved Customer Reports > View data: Password field will be removed from ALL saved reports; customer sites will be altered
  • BC CRM APIs > ContactList_Retrieve, Contact_RetrieveByEmailAddress, Contact_RetrieveByEntityID, Contact_RetrieveByExternalID, Contact_RetrieveByUsernamePassword, Contact_Retrieve, Contact_Retrieve (message name Contact_Retrieve2), Contact_Retrieve (message name Contact_Retrieve3) - Password field will return an empty value.
  • Moved in our January release: BC Admin > Email Marketing > Create campaign - {tag_recipientpassword} will be deprecated and customers will be unable to send the password in email campaigns; when running the campaign, the tag will return an empty value.

December security update FAQ

Q: Can a Partner or Site Admin still update a CRM user password in the Admin UI?
A: Yes, Site Admins and Partners can still enter a new CRM user password through the Edit Customer UI. The new value will be saved and used to login to secure zones.

Q: How can a Partner or Site Admin help CRM users recover their passwords?
A: Since the CRM user password is no longer readable by Site Admins or Partners in Report or in Manager Customer UIs, we encourage Partners to use the following methods to help customers retrieve their passwords:

  • Use "Email Login Details" from Customer Details > Manage Customer Subscriptions screen
  • Update login pages to include a "Forgot Password" form which customers can use to retrieve their secure zone passwords; Read the Allowing Customers to view and update CRM details article on the Business Catalyst Knowledge base for more information on how to help secure zone customers retrieve their passwords.

Q: What happens when password field is left in the import file?
A: We will update the import functionality so that it does not overwrite the existing password with a blank password. Starting with next release, leaving the password field blank, will keep the existing password. The following uses cases are going to apply when updating or inserting customers through import & API:

  • If contact exists in CRM and password field is left blank in the import file, the system will keep the value existing in the database
  • If contact exists in CRM and password field includes a value in the import file, the system will update the password with the value provided in the import file
  • If contact does not exists in CRM and password field is left blank in the import file, the system will create a new contact and will not generate a password for it
  • If contact does not exists in CRM and password field includes a value in the import file, the system will create a new contact and create a password based on the value provided in the import file

Q: Following the January release, can Partners or Site Admins still automate the Secure Zone login by appending username and password to an URL?
A: No. Starting with our January release, site customers will have to enter username and password when accessing a secure zone. To avoid entering login credentials the next time they access the site, site customers can check the "Remember me" checkbox.

Q: Following the January release, can partners send the login details to contacts created using import or APIs?
A: Starting with our January release, we will replace the existing workflow used to send login information with a more secure one. Partners will be able to include in the email a one time token which will redirect first time users to a screen where they can enter their password.

We will send a separate email communication to all Partners whose sites are using customer reports or APIs to retrieve CRM user passwords.

Please make sure that your customers and team members are aware of these important updates.

Thank you for all of your help and support,

Cristinel Anastasoaie
Adobe Business Catalyst Product Manager

View Comments

Today's "guest spot" article is written by Cesar Keller from Simpleflame and Kiyuco, based on their presentation during the BC Unconference at Adobe MAX 2010.

The mission of Kiyuco is to educate and train the growing community of BC partners. We aim to provide relevant, and practical video-based tutorials to get real things done with BC.

Given that this was to be a site training people on how to do awesome things on BC, we couldn’t think of not using BC to deliver the content.

Interestingly, the needs of running a subscription-based service are very effectively addressed by the modules and features inside BC. For example, the ability to have recurring payments, paid access to secure zones and email marketing are all built in and address the core needs of running such a service. Not only did we want to use BC, but it “fit the bill” for what we needed.

Key BC Modules used

While building Kiyuco, we used many of the typical components inside BC to make things happen. There are a few key features that really stand out from the typical BC components, as they enabled us to do some great things that help the site run smoothly.

Tutorial Web App

The first of these is the main web app that contains all of the tutorials. When we set out to build Kiyuco one of the core goals was to establish some good SEO practices. And when you consider that the content is locked down for members only, this creates a bit of a conflict. The challenge was that somehow we had to allow complete exposure for parts of the content, while hiding the members only content. We also wanted to ensure that we didn’t make things hard to use, so this meant we needed a single page for each video that was both available to the public and provided secure content when appropriate.

Web Apps

We accomplished this task by combining a few components inside Business Catalyst. All of the magic happens inside of the detail view for the main tutorials web app. Here the detail view is used much as you would expect, and it contains the standard information about the tutorial; basically everything but the actual video and its resources are in the detail view. This is the standard view for a non-logged in user.

If an authenticated member visits the same page, then we use JavaScript to load the video content from a page inside a secure zone. This content is actually displayed using the backup list template. By doing so, we get to store all of the content to make a single tutorial in a single web app item. This means maintenance is simplified by having all of the information for the tutorial in a single web app item, as well as accommodating the need to secure a portion of the detail page. 

So, the end result is a single page to view the video, regardless of if you are logged in or not. And we maintain real security such that only registered members can access the full content. As a result, we have visible results in terms of search engine traffic based on the contents describing our videos and the problems they solve.

Secure zones

A huge key to making this membership-based site work are the secure zone options that BC offers. This begins in a very simple way; if you complete the registration form, you are automatically added to the appropriate zone and immediately have access. From there, things get a bit more complex.

Secure Zones

For starters, BC allows you to not only sell access to a secure zone, but you can sell access with a recurring payment. This powerful feature would typically be very time consuming to build or integrate with a third party service. Not so with BC; set a few options and you’re selling secure zone access. This alone saved us countless hours.

The tricks with secure zones don’t end there though; they actually enabled several other key features on the site. For example, the free trial feature is also accomplished by adding people to a special zone with a short expiration date; again, a very easily accomplished task inside BC.

Finally, we wanted users to be able to access their account section even if their subscription has expired so that they can update their billing info without having to call us. So, using the API, we automatically add all users to a secure zone titled My Account. This zone doesn’t have access to the videos, but it does have access to the account section of the site. In this way, users can easily maintain their personal and payment information.

Secure zones are a very powerful feature of BC that were critical in making Kiyuco happen. From a development standpoint, this feature alone not only made Kiyuco possible, but provides such a suite of features that building this outside of BC would have been far too expensive to even consider. This strikes right at the core of what makes BC so powerful; you can build incredible things very quickly and cost effectively.

Email marketing

An important part of running a website that aims to sell something is email marketing. Again, this is an area that BC really provided a boost in implementing and maintaining Kiyuco a breeze. This begins when a user registers and is automatically added to a weekly update email list. This simple step required zero effort since email marketing is integrated right into BC. Since we don’t need to use a third party service for this, the entire process is simplified to the point of not being any work at all.

One problem that any service like this deals with is how to handle subscriptions that expire. While the system will automatically remove people from the secure zone to ensure they can no longer access the content, it doesn’t offer anything in the way of effectively alerting the user to encourage them to stay. Users with failed payments are added to a mailing list that is tied to a loyalty campaign that will send them automatic emails over the course of 5 days. If they update their billing info at any point in the process they are automatically removed from the list. The entire process is visible inside the CRM.


Over the course of building Kiyuco we did run across a number of situations where BC did not offer options to execute certain things. In such cases, the API allowed us to do things beyond the norm.

The API was particularly helpful in handling failed payments. We used the API to add the user to the appropriate mailing list which triggers a loyalty campaign. In this way, the API simply connected the invoicing system to a loyalty campaign; both standard BC components. The API is then used to remove them from the campaign after their payment information is updated. This fully automated process ensures the site can scale without producing an overwhelming amount of support issues for maintaining accounts.

A natural part of a membership site like Kiyuco is a free trial. We used the API to initiate an email verification routine. Without this, users could simply use the free trial form to sign in using any bogus information. Instead, the API triggers a routine that forces them to verify their email address. What we really love about this process though is that all of the keys to make this happen are stored in custom CRM fields. This means we don’t need a secondary database of information to maintain or worry about. Once verified, the API adds the user to the appropriate secure zone so they can begin their trial. Again, the API simply connects two BC modules together to accomplish a desired result.


Building Kiyuco has been an awesome adventure. Along the way, we learned a lot about what is possible inside BC and every time we were stumped, we found a simple way to use BC to solve the problem at hand. In the end, it is obvious that not only did BC make building the site much easier and faster, but it added so much value to the mix that there is no way it would have ever been built without it.

View Comments