Re: Web service question...

[Pete Hall <pete@xxxxxxxxxxxxxx>]

Yes. That's true. It would not be possible to use native i credential 
validation unless you used something that could be decrypted.

On Thu, 21 Jul 2011 16:22:27 -0700, Rory Hewitt wrote:

> Pete,
>
> But surely that assumes that the password validation 'bit' on the server
> knows what each user's password is (so it can compare *its* salted hash
> to the one passed from the client)...
>
> Rory
>
> On Thu, Jul 21, 2011 at 3:35 PM, Pete Hall <pete@xxxxxxxxxxxxxx> wrote:
>
> > On Thu, 21 Jul 2011 09:09:39 -0700, Rory Hewitt wrote:
> >
> > > That all being said, yes, if you sent your userid/password over HTTP,
> > > there would be some risk. However, you could either use SSL or you
> > > could use a 'dummy' userid/password (i.e. a userid which isn't an IBM
> > > i userid), and DB2WSE has its own 'security model' to process those.
> > > That way, you could give people outside the organization a
> > > userid/password which they could use to access certain files in
> > > certain specific ways. You could even specify exactly which queries
> > > they could run.
> >
> > You could also provide a "salt" value from the server, which the client
> > uses to produce a hash from the "salt" value concatenated with the
> > password. The hash  is then compared with the value calculated from the
> > user's password on the server. The actual password is never sent across
> > the net, and the "salt" value changes every time it is requested, has a
> > relatively short lifespan, and is destroyed as soon as it is used to
> > authenticate, regardless of whether it is successful or not. It's
> > pretty easy, although the user name does have to be sent in the clear.
> >
> > --
> > Pete Hall
> > pete@xxxxxxxxxxxxxx