How to require a password change in Microsoft Access 2007?

[Jesse Jones]

I am using Access 2007 and I am a complete ignoramus with this stuff.


I have designed a modal login form for my database that is working perfectly. I did this by placing an invisible dlookup that finds the correct password for the employee id that was entered as the username. This lookup is compared to the password the user entered and, if they are equal, the form closes.

Here is the code that I used:

Private Sub cmmndLogIn_Click()
 
'Check to see if data is entered into UsernameSelect
 
    If IsNull(Me.UsernameSelect) Or Me.UsernameSelect = "" Then
        MsgBox "You must select the name of a current call center employee.", vbOKOnly, "Required Data"
            Me.UsernameSelect.SetFocus
        Exit Sub
    End If
    'Coded in by Jesse Jones on 1/21/10
 
'Check to see if data is entered into PasswordEnter
 
    If IsNull(Me.PasswordEnter) Or Me.PasswordEnter = "" Then
        MsgBox "You must provide a password.", vbOKOnly, "Required Data"
            Me.PasswordEnter.SetFocus
        Exit Sub
    End If
    'Coded in by Jesse Jones on 1/21/10
 
'Lookup correct password for value entered in UsernameSelect
 
    Me.EmpPasswordLookup.Value = DLookup("[EmpPassword]", "Employees", "[EID] ='" & Me.UsernameSelect & "'")
    'Coded in by Jesse Jones on 1/21/10
 
'Compare value of PasswordEnter to EmpPasswordLookup
 
    If Me.PasswordEnter.Value = Me.EmpPasswordLookup.Value Then
 
 
        'Close logon form
 
        DoCmd.Close acForm, "formLogOn", acSaveNo
 
    Else
            MsgBox "Invalid Username/Password. Please try again.", vbOKOnly, "Invalid Entry!"
        Me.PasswordEnter.SetFocus
        Exit Sub
    End If
    'Coded in by Jesse Jones on 1/21/10
 
 
End Sub
    'Coded in by Jesse Jones on 1/21/10
 

What I would like to do is require a password change if the user's password is the default password assigned to all new employees ("setup1").

So, if the password is "setup1" I want to require it to be changed automatically through a form. If it is any other password, I simply want it to be authenticated.

Can anyone please help me with this? This is the first design work I have ever done.

Thank you!

[beacon]

Hi Jesse,

Welcome to Bytes!

It looks like you've basically got the problem solved. You just need to add a couple of lines of code before line #28. Type in:

If Me.EmpPasswordLookup.Value = "setup1" Then
     Msgbox "You must change your password"
     Exit Sub
End If
 

Instead of using the Exit Sub line, you could use...

DoCmd.Close Me.Name
DoCmd.OpenForm "YourPasswordChangeForm"
 

...to close the current form and open the password change form.

Hope this helps and good luck,
beacon

[Rabbit]

Can't the users edit the table directly and change their password and see other people's passwords?

[Jesse Jones]

Perfect. Thanks for your help, Beacon. I knew it was simple, but I didn't know what it was.

They can right now, rabbit, but I'm writing user-level permissions. When this goes live, they won't even know that table exists.

[Rabbit]

Access 2007 right? Didn't they remove user level security? Or are you implementing user level security through VBA? That's not very secure since you can just stop code from running.

Anyways, you should probably read this article before you decide to store everything as plaintext. http://www.codinghorror.com/blog/200...correctly.html

Either way, if security is a real concern, using Access to implement it is not the best choice.

[Jesse Jones]

Rabbit, thanks for the tips and the link. You're right, storing passwords is always a security concern. However, this is in internal database which will never be open to public. Security is not my highest priority on this database. I can admit that. My goals are 1. basic security to keep honest users and those who aren't grasping their training quickly from destroying this database and 2) to auto enter user information into various forms and datasheets.

Having said that, I am aware of the shift bypass key (I assume this is to what you are referring, but as I said, I am below a novice on this stuff) but also understand that there is a way to disable this.

Thank you for the advice. If I am totally missing the boat, please feel free to let me know. I appreciate the tips and insight.

[Rabbit]

As long as you're aware of the implications and the risk is not a concern then it shouldn't be a problem.

[beacon]

@Jesse - I'm glad it worked for what you're doing Jesse. Good luck with the rest of the project.

@Rabbit - Not to hijack Jesse's post, but what other methods would you suggest to secure a database? Is it possible to encrypt passwords using hash values instead of as plain text?

[Rabbit]

Yes, you can encrypt a password using a hash. A hash is a one way encryption. Towards the bottom of this thread, we discuss password hashing. http://bytes.com/topic/access/answer...ption-password

If you want to discuss other options, please create a new thread and we can go over it there.