Re: Web service question...

[Rory Hewitt <rory.hewitt@xxxxxxxxx>]

Pete,

But surely that assumes that the password validation 'bit' on the server
knows what each user's password is (so it can compare *its* salted hash to
the one passed from the client)...

Rory

On Thu, Jul 21, 2011 at 3:35 PM, Pete Hall <pete@xxxxxxxxxxxxxx> wrote:

> On Thu, 21 Jul 2011 09:09:39 -0700, Rory Hewitt wrote:
>
> > That all being said, yes, if you sent your userid/password over HTTP,
> > there would be some risk. However, you could either use SSL or you could
> > use a 'dummy' userid/password (i.e. a userid which isn't an IBM i
> > userid), and DB2WSE has its own 'security model' to process those. That
> > way, you could give people outside the organization a userid/password
> > which they could use to access certain files in certain specific ways.
> > You could even specify exactly which queries they could run.
>
> You could also provide a "salt" value from the server, which the client
> uses to produce a hash from the "salt" value concatenated with the
> password. The hash  is then compared with the value calculated from the
> user's password on the server. The actual password is never sent across
> the net, and the "salt" value changes every time it is requested, has a
> relatively short lifespan, and is destroyed as soon as it is used to
> authenticate, regardless of whether it is successful or not. It's pretty
> easy, although the user name does have to be sent in the clear.
>
> --
> Pete Hall
> pete@xxxxxxxxxxxxxx
> --
> This is the RPG programming on the IBM i / System i (RPG400-L) mailing list
> To post a message email: RPG400-L@xxxxxxxxxxxx
> To subscribe, unsubscribe, or change list options,
> visit: http://lists.midrange.com/mailman/listinfo/rpg400-l
> or email: RPG400-L-request@xxxxxxxxxxxx
> Before posting, please take a moment to review the archives
> at http://archive.midrange.com/rpg400-l.