Is there a way to validate users already in Sybase db through a web interface?

[former_SQLA_member1694978]

I have to build a web interface using Sybase 11 backend. The database already has users and passwords that are generated by another application using GRANT CONNECT or ADD_USER statements. Is there a way to validate users against this database without having to create a full membership provider?

[MCMartin]

If you talk about ASP.NET MembershipProvider it is not so much effort to do this. You have to implement only the ValidateUser function to get it working. Only in the case that you want to allow the user to do self-administration than you will have to implement the rest too.

In

public override bool ValidateUser(string Username, string Password)

you get the user and password in clear text and can use this e.g. in an

OdbcConnection con=new OdbcConnection(string.Format("dsn=...;uid={0};pwd={1}",Username,Password));

If you can afterwards open the connection without an exception you know that the credentials have been the right ones.

[former_SQLA_member1694978]

The problem with this is the encryption of the passwords. Aren't Sybase's passwords stored as one-way hashes?

[MCMartin]

Yes, but if you use the credentials to open the connection to the sybase db you will see if the connection is successful or not. If the password is wrong you will get an according exception. See edit above.

[VolkerBarth]

@Dan: From a security point of view, I think the approach as given by Martin and Mark is the correct one: Just try to find out whether the given credentials work - that's far better (and less error-prone and compatible) than somehow "lookup" the correct credentials and compare them with the given ones...