Is there a way to validate users already in Sybase db through a web interface?

[former_SQLA_member1694978]

I have to build a web interface using Sybase 11 backend. The database already has users and passwords that are generated by another application using GRANT CONNECT or ADD_USER statements. Is there a way to validate users against this database without having to create a full membership provider?

[MarkCulp]

I'm not familiar with ASP.Net MembershipProvider, but an alternative would be to create an SA web service with AUTHORIZATION ON and then attempt do a web service call to the SA web service providing the user ID/PWD to verify that the credentials were correct.

E.g.

CREATE WEB SERVICE Validate_User
  TYPE 'raw' 
  AUTHORIZATION ON
  USER "public"
  AS select 'OK' from Dummy;

Then start the SQL Anywhere server using "-xs http" switch

Then send a request to http://username:password@yourhost.com/Validate_User (or equivalent using Ado.Net). If the credentials are correct, you will get an "OK" response back. If not, you will get an error back.

Of course, you should use HTTPS so that the credentials are transferred securely and therefore you should add "SECURE ON" to the web service definition. (Exercise left to the reader - see "-xs https" server switch in the docs :-).

[MCMartin]

If you talk about ASP.NET MembershipProvider it is not so much effort to do this. You have to implement only the ValidateUser function to get it working. Only in the case that you want to allow the user to do self-administration than you will have to implement the rest too.

In

public override bool ValidateUser(string Username, string Password)

you get the user and password in clear text and can use this e.g. in an

OdbcConnection con=new OdbcConnection(string.Format("dsn=...;uid={0};pwd={1}",Username,Password));

If you can afterwards open the connection without an exception you know that the credentials have been the right ones.

[former_SQLA_member1694978]

The problem with this is the encryption of the passwords. Aren't Sybase's passwords stored as one-way hashes?

[MCMartin]

Yes, but if you use the credentials to open the connection to the sybase db you will see if the connection is successful or not. If the password is wrong you will get an according exception. See edit above.

[VolkerBarth]

@Dan: From a security point of view, I think the approach as given by Martin and Mark is the correct one: Just try to find out whether the given credentials work - that's far better (and less error-prone and compatible) than somehow "lookup" the correct credentials and compare them with the given ones...