Re: How to validate passwords without storing them anywhere.

If using IWS servers you can use the new user registry[1] support. You
indicate whether web service is protected and have IWS server authenticate
for you. Then when your program or service program is called you can be
assured that person has been authenticated.

Once the user has been authenticated, you have the option to during
deployment to indicate whether web service is to run under that
authenticated user, or under a specific user profile.

The user registry by default is based on user profiles, but you can also
base it on a validation list or an IFS file.


[1] https://www.ibm.com/support/pages/node/6396442


"MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> wrote on 03/17/2021
12:29:13 PM:

From: Rob Berendt <rob@xxxxxxxxx>
To: Midrange Systems Technical Discussion

<midrange-l@xxxxxxxxxxxxxxxxxx>

Date: 03/17/2021 12:29 PM
Subject: [EXTERNAL] How to validate passwords without storing them

anywhere.

Sent by: "MIDRANGE-L" <midrange-l-bounces@xxxxxxxxxxxxxxxxxx>

-- How to verify passwords without ever storing passwords.
-- Thanks to Darren Strong of Dekko.

-- The basic concept is that you do not store the password.
-- Instead you store a common string encrypted by the password.

-- As a war on 5250 tools the "short names" are obscured.

set current schema = 'ROB';
CREATE OR REPLACE TABLE Security_table for system name T000000001
(
Security_id for column C000000001 varchar(100) ALLOCATE(10) not
null constraint Security_table_primary_key PRIMARY KEY,
Security_name for column C000000002 varchar(100) ALLOCATE(25) not

null,

Password_Encryption for column C000000003 varchar(256) FOR BIT DATA
)
RCDFMT T00000001R
;
-- Let's say the password is Budweiser#01.
-- So you encrypt the word VALID with that as an encryption key and
all you are really storing is VALID.
insert into Security_table (
Security_id, Security_name, Password_Encryption)
Values('ROB', 'Rob Berendt', ENCRYPT_TDES(varchar('VALID'),
'Budweiser#01'));
-- Now when they enter their password you pass that as a decryption
key to see if it is valid.
Select DECRYPT_CHAR(Password_Encryption, 'Budweiser#01')
from Security_table
where Security_id = 'ROB';
-- Test to see if the user 'ROB' was found'
-- Test to see if the encryption key was valid by checking the

valuereturned.

-- If the value returned was not the word VALID the person entered
an invalid password.
-- Or don't let the user know they guessed the userid and return
generic error if either is invalid.

Rob Berendt
--