Framework Security

Classic Servoy
1

I need to validate the password of a user created in the Security framework external from Servoy.

The sec_user_password table seems to hold the password in the column password_value.

I am led to believe that the MD5 hash algorithm is being applied to the password but do not think this is the case.

For example, in the latest framework V4.0.0 sampleuse_navigation we have the user called testuser with password of ‘testuser’.

The password_value field holds the value ‘kS7IA7LOSeSlQQaNSVq1cA==’. However, the MD5 Hash Base 64 value for ‘testuser’ is ‘XZxoxsUO09AqL89U9jmTtg==’ and the MD5 Hash Base 16 value is ‘5d9c68c6c50ed3d02a2fcf54f63993b6’.

Can anybody please help and let me know how I get to the value in the password_value field as it does not appear to be MD5 Hash.

Thanks

2

Hi,
The md5 hash was used in the older versions of the framework. From v4 the framework uses PBKDF2.
Have a look at the function svy_sec_checkUserPassword in svy_sec_authenticate.

Jos.

3

Jos,

Thanks for the pointer to the relevant parts of the framework - however I still don’t think all is right - heres the code from the framework:-

if (md5Hash) {
isPasswordValid = (md5Hash == utils.stringMD5HashBase64(authObj.password));
if (isPasswordValid) {
// Convert to PBKDF2
/** @type {JSFoundSetdb:/svy_framework/sec_user_password} */
var fsUserPasswords = databaseManager.getFoundSet(authObj.framework_db, “sec_user_password”);
fsUserPasswords.addFoundSetFilterParam(‘user_password_id’, ‘=’, userPasswordId);
fsUserPasswords.loadAllRecords();
var newSaltAndHash = scopes.svySecurityManager.calculatePBKDF2Hash(authObj.password);
fsUserPasswords.password_hash = newSaltAndHash.hash;
fsUserPasswords.password_salt = newSaltAndHash.salt;
fsUserPasswords.password_version = scopes.svySecurityManager.PBKDF2_CURRENT_ITERATION_VERSION;
fsUserPasswords.password_value = null;
databaseManager.saveData(fsUserPasswords);
}
} else if (PBKDF2Hash && PBKDF2Salt) {
isPasswordValid = scopes.svySecurityManager.validatePBKDF2Hash(authObj.password, PBKDF2Salt, PBKDF2Hash, PBKDF2Version);
}

function calculatePBKDF2Hash(password) {
var hash;

// in Servoy 6.1.4 and lower the library used to calculate the PBKDF2 hash
// is not sent to the Smart client and cannot be used
// TODO: Remove this silly workaround when 6.1.5 is released
var versionNum = getServoyVersionNumber();
if (versionNum > 6104) {
hash = utils.stringPBKDF2Hash(PBKDF2_PEPPER + password, PBKDF2_CURRENT_ITERATION);
} else {
PBKDF2_CURRENT_ITERATION_VERSION = 0;
var someSalt = utils.stringLeft(utils.stringMD5HashBase64(application.getUUID().toString()) , 20);
hash = utils.stringMD5HashBase64(someSalt + password + PBKDF2_PEPPER);
hash = someSalt + “:0:” + hash;
}
var hashParts = hash.split(“:”);
/** @type {Number} */
var iterations = parseInt(hashParts[1]);
return {salt: hashParts[0], hash: hashParts[2], iterations: iterations, iterationVersion: PBKDF2_CURRENT_ITERATION_VERSION};
}

My password value is not generated from MD5 16 or MD5 64 as this would yield either ‘5d9c68c6c50ed3d02a2fcf54f63993b6’ or ’ XZxoxsUO09AqL89U9jmTtg=='.

It cannot be using PBKDF2 and this yields ‘56F321F05CAC61E6:5000:0C4809C957B1238238D108DD8A714406F9D6BA86’ and these would then populate into password_hash and password_salt and leave password_value as null and my data only has a value in password_value of what appears to be a MD5 64 hash of ‘kS7IA7LOSeSlQQaNSVq1cA==’.

I am obviously missing something here.

4

you are using version 4 of the framework? Then the password table should not enter a value into the password_value column, but it should store data in the password_hash and password_salt values.
I’ve just created a new user in my framework and that is where the password is stored in my solution.

5

Couldn’t you create a small web service solution, for example, that uses the API to check the password? Something like

var user = scopes.svySecurityManager.getUser(id);
var valid = user.isPasswordValid(password);

6

Patrick,

Thanks for your reply.

I don’t have a problem creating a Servoy Restful web service which validates to the framework.

The whole point of my question was that I need authentication to the framework from outside Servoy. I need to provide access to the Postgres data to a third party who are going to write some PHP code to access certain parts of my solution. The third party does not use Servoy but do need to authenticate to the framework.

Thanks again.