473,322 Members | 1,401 Online
Bytes | Software Development & Data Engineering Community
Post Job

Home Posts Topics Members FAQ

Join Bytes to post your question to a community of 473,322 software developers and data experts.

validate password within PL/SQL?

Hi! I'm looking for a way to validate a password within PL/SQL. I want to
write

CREATE PROCEDURE change_password(old_password IN VARCHAR2)
IS
BEGIN
-- check if old_password is correct... but how?

I can get the hashed value of the password from DBA_USERS, of course, but is
there a way to hash old_password to see if it matches? (I wouldn't be
surprised if Oracle doesn't supply access to its one-way password hashing
algorithm... too useful for a password cracker...)

I can't actually try a CONNECT statement from within PL/SQL, right? And even
if I could, that would kill my current connection, right? That's no good...

Of course, because the user logged in successfully, they obviously had the
correct password at one point. But what if they logged in, left their desk,
and now somebody else is trying to change their password? Limiting idle_time
in the user's profile reduces the risk of this, but it's also really
annoying, especially if the time is short enough to protect every stroll to
the coffeepot.

The PASSWORD command in SQL*Plus prompts for old password, but I'm trying to
put this in a procedure that can be called from a GUI.

OK, here's an idea! I can create a dummy user identified by the supplied
old_password, then SELECT PASSWORD FROM DBA_USERS to see if the hashed
password of the dummy user matches the hashed password of the application
user... nope, didn't work! Apparently the algorithm doesn't have a simple 1
clear-text-password: 1 hashed-password mapping; each username/password
combination gets a different result.

As you can see, I'm running out of ideas. Can anyone help?

Thanks very much!
- Catherine
http://profiles.yahoo.com/arcticturtle
----- Posted via NewsOne.Net: Free (anonymous) Usenet News via the Web -----
http://newsone.net/ -- Free reading and anonymous posting to 60,000+ groups
NewsOne.Net prohibits users from posting spam. If this or other posts
made through NewsOne.Net violate posting guidelines, email ab***@newsone.net
Jul 19 '05 #1
3 14463
I may not be able to help you excatly what are u trying to do , but
here is one tip .may it help you.
For example
if you get the hashed values of a passward say "ABC" and hashed
values is say "qwer" now you change the psswrd ABC to "def".
Now do this

alter user test identified by 'qwer' .

now the passward is again ABC
;)
Faheem

arktikturtle@correctthe_spelling.yahoo.com wrote in message news:<br**********@news.netmar.com>...
Hi! I'm looking for a way to validate a password within PL/SQL. I want to
write

CREATE PROCEDURE change_password(old_password IN VARCHAR2)
IS
BEGIN
-- check if old_password is correct... but how?

I can get the hashed value of the password from DBA_USERS, of course, but is
there a way to hash old_password to see if it matches? (I wouldn't be
surprised if Oracle doesn't supply access to its one-way password hashing
algorithm... too useful for a password cracker...)

I can't actually try a CONNECT statement from within PL/SQL, right? And even
if I could, that would kill my current connection, right? That's no good...

Of course, because the user logged in successfully, they obviously had the
correct password at one point. But what if they logged in, left their desk,
and now somebody else is trying to change their password? Limiting idle_time
in the user's profile reduces the risk of this, but it's also really
annoying, especially if the time is short enough to protect every stroll to
the coffeepot.

The PASSWORD command in SQL*Plus prompts for old password, but I'm trying to
put this in a procedure that can be called from a GUI.

OK, here's an idea! I can create a dummy user identified by the supplied
old_password, then SELECT PASSWORD FROM DBA_USERS to see if the hashed
password of the dummy user matches the hashed password of the application
user... nope, didn't work! Apparently the algorithm doesn't have a simple 1
clear-text-password: 1 hashed-password mapping; each username/password
combination gets a different result.

As you can see, I'm running out of ideas. Can anyone help?

Thanks very much!
- Catherine
http://profiles.yahoo.com/arcticturtle
----- Posted via NewsOne.Net: Free (anonymous) Usenet News via the Web -----
http://newsone.net/ -- Free reading and anonymous posting to 60,000+ groups
NewsOne.Net prohibits users from posting spam. If this or other posts
made through NewsOne.Net violate posting guidelines, email ab***@newsone.net

Jul 19 '05 #2
arktikturtle@correct_the_spelling.yahoo.com wrote in message news:<br**********@news.netmar.com>...
Hi! I'm looking for a way to validate a password within PL/SQL. I want to
write

CREATE PROCEDURE change_password(old_password IN VARCHAR2)
IS
BEGIN
-- check if old_password is correct... but how?
The easiest way I could envision doing something like this would be to
create a Java stored procedure that attempted to connect with the
supplied username & password.
OK, here's an idea! I can create a dummy user identified by the supplied
old_password, then SELECT PASSWORD FROM DBA_USERS to see if the hashed
password of the dummy user matches the hashed password of the application
user... nope, didn't work! Apparently the algorithm doesn't have a simple 1
clear-text-password: 1 hashed-password mapping; each username/password
combination gets a different result.


I'd strongly suspect that the hash takes into account at least the
username & the machine the database is on. It would be really
unfortunate if I could take information from DBA_USERS on the
production machine, copy it over to my laptop, and start cracking
passwords. Not incorporating username & machine information into the
hash's salt would allow this sort of thing, so I'm pretty darn certain
Oracle doesn't allow it.

Justin Cave
Distributed Database Consulting, Inc.
www.ddbcinc.com/askDDBC
Jul 19 '05 #3
arktikturtle@correct_the_spelling.yahoo.com wrote:
Hi! I'm looking for a way to validate a password within PL/SQL. I want to
write

CREATE PROCEDURE change_password(old_password IN VARCHAR2)
IS
BEGIN
-- check if old_password is correct... but how?

I can get the hashed value of the password from DBA_USERS, of course, but is
there a way to hash old_password to see if it matches? (I wouldn't be
surprised if Oracle doesn't supply access to its one-way password hashing
algorithm... too useful for a password cracker...)

I can't actually try a CONNECT statement from within PL/SQL, right? And even
if I could, that would kill my current connection, right? That's no good...

Of course, because the user logged in successfully, they obviously had the
correct password at one point. But what if they logged in, left their desk,
and now somebody else is trying to change their password? Limiting idle_time
in the user's profile reduces the risk of this, but it's also really
annoying, especially if the time is short enough to protect every stroll to
the coffeepot.

The PASSWORD command in SQL*Plus prompts for old password, but I'm trying to
put this in a procedure that can be called from a GUI.

OK, here's an idea! I can create a dummy user identified by the supplied
old_password, then SELECT PASSWORD FROM DBA_USERS to see if the hashed
password of the dummy user matches the hashed password of the application
user... nope, didn't work! Apparently the algorithm doesn't have a simple 1
clear-text-password: 1 hashed-password mapping; each username/password
combination gets a different result.

As you can see, I'm running out of ideas. Can anyone help?

Thanks very much!
- Catherine
http://profiles.yahoo.com/arcticturtle
----- Posted via NewsOne.Net: Free (anonymous) Usenet News via the Web -----
http://newsone.net/ -- Free reading and anonymous posting to 60,000+ groups
NewsOne.Net prohibits users from posting spam. If this or other posts
made through NewsOne.Net violate posting guidelines, email ab***@newsone.net


There may be no need for it; any user is allowed to change his
own password with "alter user <current_user> identified by <new_password>"

SQL> create user demo identified by demo default tablespace users;
User created.

SQL> grant create session to demo;
Grant succeeded.

SQL> connect demo/demo@o920
Connected.

SQL> alter user demo identified by nemo;
User altered.

SQL> connect demo/nemo@o920
Connected.

So, create your procedure with invoker's rights and
change the password - as you mention, the user is
logged on, so has to know his/her password.

The obvious risk is someone else is actually changing
the password, while the user strolled off, leaving the
application open.
I'll leave it to you to shoot those endusers ;-)
--
Regards, Frank van Bortel

Jul 19 '05 #4

This thread has been closed and replies have been disabled. Please start a new discussion.

Similar topics

5
by: Joeri KUMBRUCK | last post by:
Hello, I'm trying to create an ASP page where users can type in a username and password, and these credential should be checked with active directory. If username and password are correct, the...
4
by: Paul Steele | last post by:
I'm writing a C# program that needs to validate an Active Directory username/password? The program will be running on a workstation that is not part of the domain. It doesn't have to do anything...
2
by: Steffen Balslev | last post by:
I tried to find a way to validate user credentials using C#, searching google and lots of other news and kb sites left me without a solution. You can use a SSPI but it's that easy to implement so...
0
by: Joeri KUMBRUCK | last post by:
Hello, I'm trying to create an ASP page where users can type in a username and password, and these credential should be checked with active directory. If username and password are correct, the...
3
by: Greg | last post by:
I am trying to figure out how to validate a userid against AD. At the time the user will be logged on as the local admin, right after puuling down a fresh image. the form asks for the userid and...
1
by: Peterwkc | last post by:
hello all expert database administrator, i truly new to access. I want to develop a website where the password and re-enter password must be same. How to i validate this in access or i need ti...
3
by: arktikturtle | last post by:
Hi! I'm looking for a way to validate a password within PL/SQL. I want to write CREATE PROCEDURE change_password(old_password IN VARCHAR2) IS BEGIN -- check if old_password is correct... but...
3
by: ojnoka | last post by:
Hi, I am a newbie. I don't know javascript. I use the free javascripts and try to understand them. I have a javascript now, to validate username and password. I paste it below. My question now. Is...
5
by: ghjk | last post by:
I have a web site with several web pages. They are having different number of variables. eg: first page having 4 variables in the form(Name, Phone, ID, Gender) second page having 10 variables in the...
0
by: ryjfgjl | last post by:
ExcelToDatabase: batch import excel into database automatically...
1
isladogs
by: isladogs | last post by:
The next Access Europe meeting will be on Wednesday 6 Mar 2024 starting at 18:00 UK time (6PM UTC) and finishing at about 19:15 (7.15PM). In this month's session, we are pleased to welcome back...
1
by: PapaRatzi | last post by:
Hello, I am teaching myself MS Access forms design and Visual Basic. I've created a table to capture a list of Top 30 singles and forms to capture new entries. The final step is a form (unbound)...
1
by: CloudSolutions | last post by:
Introduction: For many beginners and individual users, requiring a credit card and email registration may pose a barrier when starting to use cloud servers. However, some cloud server providers now...
1
by: Defcon1945 | last post by:
I'm trying to learn Python using Pycharm but import shutil doesn't work
1
by: Shællîpôpï 09 | last post by:
If u are using a keypad phone, how do u turn on JavaScript, to access features like WhatsApp, Facebook, Instagram....
0
by: af34tf | last post by:
Hi Guys, I have a domain whose name is BytesLimited.com, and I want to sell it. Does anyone know about platforms that allow me to list my domain in auction for free. Thank you
0
by: Faith0G | last post by:
I am starting a new it consulting business and it's been a while since I setup a new website. Is wordpress still the best web based software for hosting a 5 page website? The webpages will be...
0
isladogs
by: isladogs | last post by:
The next Access Europe User Group meeting will be on Wednesday 3 Apr 2024 starting at 18:00 UK time (6PM UTC+1) and finishing by 19:30 (7.30PM). In this session, we are pleased to welcome former...

By using Bytes.com and it's services, you agree to our Privacy Policy and Terms of Use.

To disable or enable advertisements and analytics tracking please visit the manage ads & tracking page.