Re: Web service question...

[Pete Hall <pete@xxxxxxxxxxxxxx>]

On Thu, 21 Jul 2011 09:09:39 -0700, Rory Hewitt wrote:

> That all being said, yes, if you sent your userid/password over HTTP,
> there would be some risk. However, you could either use SSL or you could
> use a 'dummy' userid/password (i.e. a userid which isn't an IBM i
> userid), and DB2WSE has its own 'security model' to process those. That
> way, you could give people outside the organization a userid/password
> which they could use to access certain files in certain specific ways.
> You could even specify exactly which queries they could run.

You could also provide a "salt" value from the server, which the client 
uses to produce a hash from the "salt" value concatenated with the 
password. The hash  is then compared with the value calculated from the 
user's password on the server. The actual password is never sent across 
the net, and the "salt" value changes every time it is requested, has a 
relatively short lifespan, and is destroyed as soon as it is used to 
authenticate, regardless of whether it is successful or not. It's pretty 
easy, although the user name does have to be sent in the clear.