Apache basic auth, mod_authn_dbd and password salt
Posted
by
Cristian Vrabie
on Stack Overflow
See other posts from Stack Overflow
or by Cristian Vrabie
Published on 2012-06-06T12:28:31Z
Indexed on
2012/06/07
16:40 UTC
Read the original article
Hit count: 244
Using Apache mod_auth_basic and mod_authn_dbd you can authenticate a user by looking up that user's password in the database. I see that working if the password is held in clear, but what if we use a random string as a salt (also stored in the database) then store the hash of the concatenation?
mod_authn_dbd requires you to specify a query to select that password not to decide if the user is authenticated of not. So you cannot use that query to concatenate the user provided password with the salt then compare with the stored hash.
AuthDBDUserRealmQuery "SELECT password FROM authn WHERE user = %s AND realm = %s"
Is there a way to make this work?
© Stack Overflow or respective owner