• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 332
  • Last Modified:

Use T-SQL to create a unique password based on UserID

I'd like to come up with some code that can use a UserID to generate a unique password. We need to convert UserIDs from a legacy system into a new one and create a 'default' password for each user and have the code available, so we can re-generate the same password at a later date. Thus the password cannot be based on something dynamic (such as the time, etc.) It does not have to be a strong passowrd, but also do not want it to be generated in such a way that someone could easily figure it our (e.g. add 4 to the UserID character so A becomes E, or such.

We will set a flag so on initial logon it will need to be changed. We do not want to create a default for everyone that is the same, because Bill may try to log onto John's account using the same password.

Again, the password generated must be repeatable, thus, using the same UserID, I will always get the same password.

Any ideas? I'd like to see it be a function.
0
dbbishop
Asked:
dbbishop
1 Solution
 
Ross TurnerManagement Information Support AnalystCommented:
some interesting ideas on password generation here:

http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=59194
0
 
Guy Hengel [angelIII / a3]Billing EngineerCommented:
If you want to be able to reuse that initial Passwort, why not store it in it's own field? That way you can easily restore it, and while the two field values are equal the user needs to change.
Just an idea.
0
 
Steve WalesSenior Database AdministratorCommented:
Once needed to do something like that - we had social security numbers stored in the payroll system, a temporary password when requested to be set up like that was set up as a certain string concatenated in front of the last 4 of someone's SSN.

Assuming that one keeps one's SSN private.... you have a password that only the user should know that can be evenly applied across everyone.
0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
dbbishopAuthor Commented:
I cannot use RAND() or any other function that would make the password un-repeatable. If I pass 'DBBISHOP' into the function, it should always return the same value. I've not worked with XOR before, but I suppose it is possible to set up a 'seed' string and XOR character by character against it. The resulting password must be displayable characters, and could be alpha (upper or lower case), numeric or special characters, with no spaces, of course.

The password must be unique for the user, but not random.

Also, SSN is not available.
0
 
dbbishopAuthor Commented:
AngelIII, cannot change the existing database schema.
0
 
Robert SchuttSoftware EngineerCommented:
Try this:
CREATE FUNCTION GetPwd
(
	@p1 varchar(100)
)
RETURNS varchar(8)
AS
BEGIN
	DECLARE @Result varchar(8)
	SET @Result = ''
	DECLARE @secret varchar(100)
	SET @secret = 'secret'
	DECLARE @charset varchar(62)
	SET @charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
	DECLARE @i int
	SET @i = 0
	DECLARE @p int
	SET @p = 0
	DECLARE @s int
	SET @s = 0
	WHILE @i < 8
	BEGIN
		SET @i = @i + 1
		SET @p = (@p % LEN(@p1)) + 1
		SET @s = (@s % LEN(@secret)) + 1
		SET @Result = @Result + SUBSTRING(@charset, (ASCII(SUBSTRING(@p1, @p, 1)) + ASCII(SUBSTRING(@secret, @s, 1))) % LEN(@charset) + 1, 1)
	END
	RETURN @Result
END
GO

Open in new window

Call it with the account name and I believe your specs are met.
0
 
Robert SchuttSoftware EngineerCommented:
I just saw your previous posts, you could add some more calculations, making it a bit more like AES encryption (thinking about that after you XOR remark) but I was under the assumption that there was no need for such stringent security on this (just not *too* easy to guess the password of another user).
0
 
dbbishopAuthor Commented:
robert_schutt, you are correct. We are doing a conversion and first time they log in, we will force them to change the password, and the new password will be encrypted and strong.

Thus, the main requirement is that they are not all the same, and that they are not easy to 'guess', no need for a strong password or encryption. Once converted, we will provide a 'cross-reference' list to admin, but in case it is misplaced, etc. they should be able to reproduce the initial passowr, becuase, without it, there is no way for the user to access the system.

I'll give your code a try this week.
0
 
dbbishopAuthor Commented:
Thanks. Works great.
0

Featured Post

Concerto Cloud for Software Providers & ISVs

Can Concerto Cloud Services help you focus on evolving your application offerings, while delivering the best cloud experience to your customers? From DevOps to revenue models and customer support, the answer is yes!

Learn how Concerto can help you.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now