Programmatically Creating Database Connections

Question

I am planning to change the database password for an enterprise geodatabase user to make it more secure.  This user's credentials appear in ArcGIS Pro projects' layers and tables, .sde files, ArcGIS Server services, the Server data store, and even in ArcMap documents.

ArcGIS Pro will not allow me to create a database connection file using the intended new password because of a Bad login user error.  I see no way to bypass this.  I was hoping to use the .sde file in my code with the updateConnectionProperties method.  But how can I supply current_connection_info and new_connection_info if I can't create both of them now?

To bypass the UI, I tried calling arcpy.management.CreateDatabaseConnection in a Python Notebook with the user's current password.  The resulting .sde file was unusable.  I believe it's because I can't supply an encrypted string for the password parameter.  A similar method, CreateDatabaseConnectionString, also expects an encrypted password string.  Encryption isn't the same as hashing, so I must suppose that ArcGIS Pro is using a private key with an algorithm to produce the needed argument for the function.  But how can I do this myself?

Any generic or specific help you can provide would be appreciated.  Your time is valuable; I am thankful you are spending some of it helping me.  Feel free to ask any questions, too.

RogerDunnGIS · Answer

The database connections do work, but they can't both work in a session.  If a password is changed while an ArcGIS Pro session is underway, then the results are unpredictable.

RogerDunnGIS · Answer

UPDATE: I ran Create Database User with username GUINEA_PIG and a password.  This is on SQL Server .  I programmatically created two geodatabase connection (.sde) files using CreateDatabaseConnection: one for the old password and one for the new.  I gave the user permissions to some datasets.  I created a map and added some layers using the connection file.  I exited all GIS software.  Then I went into SQL Server Management Studio and changed the password for GUINEA_PIG to the new password.  Now neither the new connection file still nor the old one work.  In ArcGIS Pro, it prompts me in a dialog to provide the password.  In ArcMap, I get a Bad login user error message.  I know the new password matches the one I used in the CreateDatabaseConnection script.

Does anyone have any ideas on why creating a database connection file with a future good password wouldn't work?

RogerDunnGIS · Answer

My apologies.  How embarrassing for me.  The password argument, passed as plain text, works  just fine.  I had programmatically created new and old password .sde files and it was the new ones that weren't working; the old ones are.  This is as it should be ,since the password hasn't been changed yet.  Well, maybe someone can benefit from this post.