How to compare passwords!?

wolfulium

Hey everyone I am trying to write a webservice for a simple login into the nav system using an external user
(assuming permissions are set up properly of course)

I wrote a code unit that I will be using as a WS and I am hung up on the password portion of the authentication

login(username : Text;password : Text) Token : Text
UserT.SETCURRENTKEY("User Name");
UserT.SETFILTER("User Name", username);
IF UserT.FINDFIRST THEN BEGIN
  IF UserPropertyT.GET(UserT."User Security ID") THEN BEGIN
         { WHAT DO I PUT HERE ?? }
         if Encrypt(password) = UserPropertyT.Password
  END;
END;

Encrypt(password: Text) ePassword : Text
{ herpity derpity }

I have looked for the function SETUSERPASSWORD to see how the passwords are created (which encryption is used). I have no interest in how to decrypt them but I am interested in the encryption.

Best way to authenticate is to take their entered password, encrypt it and compare it to the stored password.

anyone help? any guidance?

Juhl

NAV WS have multiple authentication systems in place, why not use that?
What if the user is a windows user, than you have nothing to compare to.

wolfulium

We are setting up external users, they will not be windows users or authenticated through that. these are customers of a client and they dont want to create/pay for users for a view.

NAV Webservices are not favorable for the external users, at least from what Ive tried with the mobile app.

Juhl

Maybe you could explain the setup a bit more.

If it’s a intermediate WebService then they should auth against that and not NAV

wolfulium

The idea is to create a customer webpage so that the they can see their information.
Without logging them into NAV.

We can set up external users with passwords (encrypted)

The website (ASP) will make a call to the webservice (code unit in NAV)
and pass the Username/password into the login function above.
the function will auth and then passback a token that contains the authentication to a NAV user that has very very very permissions to gather the information needed and return it to the webpage.

Thats as lamen as I can get it.

Juhl

Don’t let users connect to NAV. Let you backend get the data on behalf of the user, then create a user database in your website backend to authenticate external users.