Apache basic auth, mod_authn_dbd and password salt

Posted by Cristian Vrabie on Stack Overflow See other posts from Stack Overflow or by Cristian Vrabie
Published on 2012-06-06T12:28:31Z Indexed on 2012/06/07 16:40 UTC
Read the original article Hit count: 244

Using Apache mod_auth_basic and mod_authn_dbd you can authenticate a user by looking up that user's password in the database. I see that working if the password is held in clear, but what if we use a random string as a salt (also stored in the database) then store the hash of the concatenation?

mod_authn_dbd requires you to specify a query to select that password not to decide if the user is authenticated of not. So you cannot use that query to concatenate the user provided password with the salt then compare with the stored hash.

AuthDBDUserRealmQuery "SELECT password FROM authn WHERE user = %s AND realm = %s"

Is there a way to make this work?

© Stack Overflow or respective owner

Related posts about apache

Related posts about authentication