Solved

Use T-SQL to create a unique password based on UserID

Posted on 2013-01-18
9
319 Views
Last Modified: 2013-01-22
I'd like to come up with some code that can use a UserID to generate a unique password. We need to convert UserIDs from a legacy system into a new one and create a 'default' password for each user and have the code available, so we can re-generate the same password at a later date. Thus the password cannot be based on something dynamic (such as the time, etc.) It does not have to be a strong passowrd, but also do not want it to be generated in such a way that someone could easily figure it our (e.g. add 4 to the UserID character so A becomes E, or such.

We will set a flag so on initial logon it will need to be changed. We do not want to create a default for everyone that is the same, because Bill may try to log onto John's account using the same password.

Again, the password generated must be repeatable, thus, using the same UserID, I will always get the same password.

Any ideas? I'd like to see it be a function.
0
Comment
Question by:dbbishop
9 Comments
 
LVL 7

Expert Comment

by:Ross Turner
ID: 38794545
some interesting ideas on password generation here:

http://www.sqlteam.com/forums/topic.asp?TOPIC_ID=59194
0
 
LVL 142

Expert Comment

by:Guy Hengel [angelIII / a3]
ID: 38794566
If you want to be able to reuse that initial Passwort, why not store it in it's own field? That way you can easily restore it, and while the two field values are equal the user needs to change.
Just an idea.
0
 
LVL 22

Expert Comment

by:Steve Wales
ID: 38794625
Once needed to do something like that - we had social security numbers stored in the payroll system, a temporary password when requested to be set up like that was set up as a certain string concatenated in front of the last 4 of someone's SSN.

Assuming that one keeps one's SSN private.... you have a password that only the user should know that can be evenly applied across everyone.
0
Master Your Team's Linux and Cloud Stack

Come see why top tech companies like Mailchimp and Media Temple use Linux Academy to build their employee training programs.

 
LVL 15

Author Comment

by:dbbishop
ID: 38794715
I cannot use RAND() or any other function that would make the password un-repeatable. If I pass 'DBBISHOP' into the function, it should always return the same value. I've not worked with XOR before, but I suppose it is possible to set up a 'seed' string and XOR character by character against it. The resulting password must be displayable characters, and could be alpha (upper or lower case), numeric or special characters, with no spaces, of course.

The password must be unique for the user, but not random.

Also, SSN is not available.
0
 
LVL 15

Author Comment

by:dbbishop
ID: 38794716
AngelIII, cannot change the existing database schema.
0
 
LVL 35

Accepted Solution

by:
Robert Schutt earned 500 total points
ID: 38794734
Try this:
CREATE FUNCTION GetPwd
(
	@p1 varchar(100)
)
RETURNS varchar(8)
AS
BEGIN
	DECLARE @Result varchar(8)
	SET @Result = ''
	DECLARE @secret varchar(100)
	SET @secret = 'secret'
	DECLARE @charset varchar(62)
	SET @charset = 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789'
	DECLARE @i int
	SET @i = 0
	DECLARE @p int
	SET @p = 0
	DECLARE @s int
	SET @s = 0
	WHILE @i < 8
	BEGIN
		SET @i = @i + 1
		SET @p = (@p % LEN(@p1)) + 1
		SET @s = (@s % LEN(@secret)) + 1
		SET @Result = @Result + SUBSTRING(@charset, (ASCII(SUBSTRING(@p1, @p, 1)) + ASCII(SUBSTRING(@secret, @s, 1))) % LEN(@charset) + 1, 1)
	END
	RETURN @Result
END
GO

Open in new window

Call it with the account name and I believe your specs are met.
0
 
LVL 35

Expert Comment

by:Robert Schutt
ID: 38794741
I just saw your previous posts, you could add some more calculations, making it a bit more like AES encryption (thinking about that after you XOR remark) but I was under the assumption that there was no need for such stringent security on this (just not *too* easy to guess the password of another user).
0
 
LVL 15

Author Comment

by:dbbishop
ID: 38799128
robert_schutt, you are correct. We are doing a conversion and first time they log in, we will force them to change the password, and the new password will be encrypted and strong.

Thus, the main requirement is that they are not all the same, and that they are not easy to 'guess', no need for a strong password or encryption. Once converted, we will provide a 'cross-reference' list to admin, but in case it is misplaced, etc. they should be able to reproduce the initial passowr, becuase, without it, there is no way for the user to access the system.

I'll give your code a try this week.
0
 
LVL 15

Author Closing Comment

by:dbbishop
ID: 38803714
Thanks. Works great.
0

Featured Post

Master Your Team's Linux and Cloud Stack!

The average business loses $13.5M per year to ineffective training (per 1,000 employees). Keep ahead of the competition and combine in-person quality with online cost and flexibility by training with Linux Academy.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

'Between' is such a common word we rarely think about it but in SQL it has a very specific definition we should be aware of. While most database vendors will have their own unique phrases to describe it (see references at end) the concept in common …
I'm trying, I really am. But I've seen so many wrong approaches involving date(time) boundaries I despair about my inability to explain it. I've seen quite a few recently that define a non-leap year as 364 days, or 366 days and the list goes on. …
This tutorial gives a high-level tour of the interface of Marketo (a marketing automation tool to help businesses track and engage prospective customers and drive them to purchase). You will see the main areas including Marketing Activities, Design …
This video shows how to quickly and easily add an email signature for all users on Exchange 2016. The resulting signature is applied on a server level by Exchange Online. The email signature template has been downloaded from: www.mail-signatures…

813 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now