How to validate a login when using a oracle database (pw-encryption?) 1

[freiheit]

Hi,

I'd like to make a password-validation with cold fusion. Username and password are stored in the view DBA_USERS of a oracle database. But the password in this view is encrypted and the user gives me the not encrypted password.

What do I have to do?

Thanks for help.
Marcus.

[sig][/sig]

 

[freiheit]

Now I am able to answer my own question.

There is no need to compare username and password in the view DBA_USERS of an oracle database with that what the user gives.

You simply use the cfquery tag and put username and password into it.

<cfquery datasource=&quot;DS&quot; name=&quot;NAME&quot; username=&quot;USERNAME&quot; password=&quot;NOT_ENCRYPTED&quot;>
any SQL-statement </cfquery>

What happens is that cold fusion connects to the oracle database by passing through the USERNAME and the not encrypted password. Oracle encrypts the password and then validates the login by looking into the view DBA_USERS. If a combination of USERNAME and encrypted password exists then the SQL-statement will be automaticaly executed. Otherwise it returns an exception.

That means any executed SQL-statement means a good login. An exception means the login was not good. [sig][/sig]

 

[celley]

typically you store an encryption key in your application.cfm, and use that to encrypt the passwords. When updating the database, do this:

<cfquery datasource=&quot;#dsn#&quot;>
Update Table_Name
Set Password = encrypt(#form.password#, name_of_key)
</cfquery>

And then when the user tries to log in, encrypt the form password to compare to the database. [sig][/sig]

 

[freiheit]

Hi celley,

your post was helpful, I will remember it for other projects.

Another problem is that I do not know the encryption code Oracle uses when creating a new database user or changing the password. And I'm sure that Oracle encrypts the password and then stores it in DBA_USERS. Maybe I should change the forum with that problem ;-)

Perhaps you have another tip?
Thanks.
Marcus [sig][/sig]