Jeff Lindborg | This is, of course, no way to get any open credential (PIN or Password) out of the database – such a practice would get us a visit from the Security Team Education Squad… not good. Most systems out there secure credentials in the same way – they are stored as one-way hashes. You cannot “decrypt” a credential, only provide a proposed password which is then hashed using the same algorithm/key/salt value etc… and it’ll tell you if they match or not. There is a stored procedure in the database for doing this (i.e. if you’re connected via ODBC for instance) – I’ll have to hunt and see if the same functionality is exposed via REST but right off hand I don’t think it is. Authentication against the GUI interfaces are restricted to your GUI PW (which is necessarily more secure than your PIN given the broader potential character set) by design – understood your purpose in trying to work around that here but also understand that by design clients aren’t supposed to be able to slip around that out of the box. |
| Please sign in to flag this as inappropriate. |