Geek Answers Handbook

Suggestions for a practical user authentication system?

I don't like reinventing the wheel, so I'm looking for an existing solution to create a simple authentication system for my application. I experimented for a while using CardSpace or OpenID inside the application, but I can’t convince the management that these will be working solutions. Of course, I could just create a simple login dialog where the username, domain and (hashed) password are stored inside the database table, and I have done this many times. I hate this decision because I consider it simply weak. And I don’t want to spend too much time making the entire system of login to the system as safe as possible, especially since I suspect that there must be existing solutions for this.

So, next to OpenID / OpenAuth and CardSpace, are there any other authentication solutions that can be used from the Delphi / WIN32 application?

Currently, the application will be used by many customers. Most of them are single-user environments, although it is likely that some of them will start having two to five users after adding this authentication system. But we want to support a client who needs to allow about 500 different users in one application. They extend to approximately 100 offices, but they all connect to the same SQL Server database. (MS Access is right now, but we give this user the option to use SQL Server instead.) To make it even more interesting, the client uses Citrix to centralize user systems, and the application has direct access to the SQL Server database. This is not an ideal setting, but again, the client does not pay for it. We just set up a test environment. Proof of the concept that the client will test for us. In the future, the shortcomings will be resolved. But now I need quick solutions, and one of them is a practical authentication system, where I do not need to write a lot of code.
+4
source share
3 answers

Have you considered using SQL Server authentication and did not allow authentication for those using the Access database?

If you are using the new native SQL Server client and SQL Server 2005, your passwords may have expired and changed from your client application. All tools for creating and managing user accounts are built into SQL Server Management Studio. And if you later decide to support Windows authentication, you just need to change the connection string.

We have a system in which users on the network use Windows authentication, so they don’t need to worry about a different username and password. For users who access the system through a VPN and are not connected to a domain machine, they use SQL authentication.

Here is the MSDN page that talks about working with passwords programmatically in SQL Server 2005

You need to make sure that your own SQL Server client is installed , but this is simple compared to the rest of ADO.

+1
source

I would suggest then

  • Delphi - since you are using Delphi :)
  • Open source - since you need to find out what is wrong if there is a problem, you probably want it to be cheap.

So here are some solutions:

http://www.torry.net/pages.php?id=313

CoWindowsAccount v.1.0 SSecurity v.1.2.1.3

http://free-password-manager-plus.software.informer.com/1.6/

+1
source

This might work for your purposes, but why not ask Windows about your current domain and username and use them as unique identifiers. Windows has already authenticated and saves users by creating new passwords or something else. I used this for a good effect. I also made it optional to include the machine name in the identifier so that the same user on different computers is also unique.

+1
source

More articles:


All Articles