Use T-SQL to create a unique password based on UserID

I'd like to come up with some code that can use a UserID to generate a unique password. We need to convert UserIDs from a legacy system into a new one and create a 'default' password for each user and have the code available, so we can re-generate the same password at a later date. Thus the password cannot be based on something dynamic (such as the time, etc.) It does not have to be a strong passowrd, but also do not want it to be generated in such a way that someone could easily figure it our (e.g. add 4 to the UserID character so A becomes E, or such.

We will set a flag so on initial logon it will need to be changed. We do not want to create a default for everyone that is the same, because Bill may try to log onto John's account using the same password.

Again, the password generated must be repeatable, thus, using the same UserID, I will always get the same password.

Any ideas? I'd like to see it be a function.
LVL 15
dbbishopAsked:
Who is Participating?
 
Robert SchuttSoftware EngineerCommented:
Try this:
CREATE FUNCTION GetPwd
(
	@p1 varchar(100)
)
RETURNS varchar(8)
AS
BEGIN
	DECLARE @Result varchar(8)
	SET @Result = ''
	DECLARE @secret varchar(100)
	SET @secret = 'secret'
	DECLARE @charset varchar(62)
	SET @charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
	DECLARE @i int
	SET @i = 0
	DECLARE @p int
	SET @p = 0
	DECLARE @s int
	SET @s = 0
	WHILE @i < 8
	BEGIN
		SET @i = @i + 1
		SET @p = (@p % LEN(@p1)) + 1
		SET @s = (@s % LEN(@secret)) + 1
		SET @Result = @Result + SUBSTRING(@charset, (ASCII(SUBSTRING(@p1, @p, 1)) + ASCII(SUBSTRING(@secret, @s, 1))) % LEN(@charset) + 1, 1)
	END
	RETURN @Result
END
GO

Open in new window

Call it with the account name and I believe your specs are met.
0
 
Ross TurnerManagement Information Support AnalystCommented:
some interesting ideas on password generation here:

http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=59194
0
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
If you want to be able to reuse that initial Passwort, why not store it in it's own field? That way you can easily restore it, and while the two field values are equal the user needs to change.
Just an idea.
0
Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

 
Steve WalesSenior Database AdministratorCommented:
Once needed to do something like that - we had social security numbers stored in the payroll system, a temporary password when requested to be set up like that was set up as a certain string concatenated in front of the last 4 of someone's SSN.

Assuming that one keeps one's SSN private.... you have a password that only the user should know that can be evenly applied across everyone.
0
 
dbbishopAuthor Commented:
I cannot use RAND() or any other function that would make the password un-repeatable. If I pass 'DBBISHOP' into the function, it should always return the same value. I've not worked with XOR before, but I suppose it is possible to set up a 'seed' string and XOR character by character against it. The resulting password must be displayable characters, and could be alpha (upper or lower case), numeric or special characters, with no spaces, of course.

The password must be unique for the user, but not random.

Also, SSN is not available.
0
 
dbbishopAuthor Commented:
AngelIII, cannot change the existing database schema.
0
 
Robert SchuttSoftware EngineerCommented:
I just saw your previous posts, you could add some more calculations, making it a bit more like AES encryption (thinking about that after you XOR remark) but I was under the assumption that there was no need for such stringent security on this (just not *too* easy to guess the password of another user).
0
 
dbbishopAuthor Commented:
robert_schutt, you are correct. We are doing a conversion and first time they log in, we will force them to change the password, and the new password will be encrypted and strong.

Thus, the main requirement is that they are not all the same, and that they are not easy to 'guess', no need for a strong password or encryption. Once converted, we will provide a 'cross-reference' list to admin, but in case it is misplaced, etc. they should be able to reproduce the initial passowr, becuase, without it, there is no way for the user to access the system.

I'll give your code a try this week.
0
 
dbbishopAuthor Commented:
Thanks. Works great.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.