Can I get the password of a logged in user un-hashed so that I can use it and their username to log that user into a database?

I'm writing modules that interface to a company?s back-end database and I would like them (the user) to each log into that database so I can set permissions per-user rather than using one username and password to log into the database and funneling everyone across that connection. It would be nice if I could use the info of an already validated user to keep them from having to log-in a second time whenever they get to a page that interfaces with the database. BTW here's some background that might make a difference in the answer. I?m using:

Windows 2003 SP1

The server is the Active Directory primary domain controller.

IIS 6.0

MS-SQL server 2000 SP4

DNN 3.1

And Tam?s Authentication & login modules

Using the username and password of a user that is in A.D. for DNN was quite nice and saves my users from having to have a log-in for there PC and the website, but now I would like it if there was a way of telling SQL server that when this authenticated user goes to this module say to delete data from the database it will use there username and password to connect to the database so that only users who I specify may delete data and if it becomes an issue with the manager and they ask me who deleted the data I can refer back to the SQL log file and find the username of the person who performed the deletion. (Not a problem yet, just trying to cover my own ;-)

For anyone not familiar with how tam?s authentication modules work, I?ll give a quick overview. When a user (who has a username and password already in Active Directory) goes to the portal for the first time and logs in using there windows username and password the module will authenticate it against Active Directory. At that point the user information is also stored in the DNN database. So the same username and password exist for the user in both A.D. and DNN. I don?t care were I get the password from as long as it will work to log the user into the SQL server, which uses Windows Authentication.

Any help would be appreciated.

Thanks, Nathan Rover

How does the e-mail password function get the password in clear text to send it to a user if it?s stored hashed in the database?

Thanks, Nathan Rover

NateDawg wrote:

Using the username and password of a user that is in A.D. for DNN was quite nice

Well, I'm still not too sure how it works but it works...

<code>

If MyBase.UserId >= 0 Then

     UserName = MyBase.UserInfo.Username.ToString()

     Password = MyBase.UserInfo.Membership.Password.ToString()

End If

</code>

It does everything I need it to do, and it works with Tam's Authentication module, and the password is returned in cleartext.
The key is to do it only to logged in users thats why I have the if statement, without it the module would crash.

thats my $.02, Nathan Rover

Well, only Tam knows due to the fact that the module is not open source...

BTW Tam, if your reading this, I would greatly appreciated if you made the source code available for the
authentication module, and I?m sure there are more programmers that feel the same way I do, but, I digress.

The way I think it works it that when a user logs in for the first time they are authenticated against AD, then
the username and password they typed in get put into the database. So, it matches what?s in AD, but it was
supplied by the user.

The major problem I have with this is, when the password changes in AD the old password will still work in
DNN. This is why I wish the authentication module was open source. But I think I can develop a hacky
work-around by making a function that will do scheduled deletion of users from the DNN database.

In reply to your question ?How did you initially create the users in DNN?? I didn?t they get added the first
time they log-in. the only non AD users are host and admin? witch I need to read up on how to promote a
user to super-user, so that I can turn my Administrator account into the super-user. So I can get rid of both
the default DNN users.

?I bet if you change the password in the database, you'd still be able to log into DNN using Windows Auth.?
Correct, and it will overwrite the password in the database when you log in, with the one in AD.

?How are your users currently logging in?  Users should never have to enter their username and password
using this method of authentication...? kinda? if they are at a computer which is logged in to the domain then
they are automatically logged in as the user who is logged on to the PC. If they come across the internet there
is a form log-in which they can use to log-in.

?I'd be quite worried if Tam's provider is somehow retrieving the users' password from active directory and
inserting it into the DNN database.? Me too?. Tam, please make the authentication module open source?.

 
Just my $.02, Nathan Rover

Wish I had the code to this! (hint hint)!

Wallew

NateDawg wrote:

The way I think it works it that when a user logs in for the first time they are authenticated against AD, then the username and password they typed in get put into the database. So, it matches what?s in AD, but it was supplied by the user.

NateDawg wrote:

?I bet if you change the password in the database, you'd still be able to log into DNN using Windows Auth.? Correct, and it will overwrite the password in the database when you log in, with the one in AD.

Ok, this is the print out from a testing module that I made... the information here will eventually be used to make a SQL connection. As you can see from the last line of the print out, this first part is what happens when the module is loaded by an anonymous user.

This is ModuleID: 364
This is UserID: -1
This is PortalID: 0
The portal name is: DotNetNuke Default Portal
The module title is: Test SQL Connection.
Are we in edit mode now?: False
The Server is: '(local)'
The Database is: 'test'
The table is: 'test'
SQL connection string: server=(local);uid=none;pwd=none;database=test

Then I went and created a user in AD (UN: testuser, Pass: 5t^y7u*i) then I logged into the portal using testuser.

This is ModuleID: 364
This is UserID: 3
This is PortalID: 0
The portal name is: DotNetNuke Default Portal
The module title is: Test SQL Connection.
Are we in edit mode now?: False
This is the Username: testuser
User Password: 5t^y7u*i
The Server is: '(local)'
The Database is: 'test'
The table is: 'test'
SQL connection string: server=(local);uid=testuser;pwd=5t^y7u*i;database=test

It works.... granted this is not the E-mail password function as per your request but, my module gets the password using the same function that the E-mail password function uses.

Well, back to programming.....
     Nathan Rover

Logged the user in with Tams Forms Authenticaiton Module.

It's in Form/ADSI Auth. mode.

It's version 3.0.13.

Nathan Rover

Just putting my 1.5 cents worth in here...

The way I figure it is working is that you enter your username/password into DNN, it uses that username/password to ask AD if it is a correct match, and AD will respond yes/no, providing the authentication necessary.  DNN doesn't "have" to store the password locally, but it theoretically "could", seeing as you already typed it into DNN in the first place. 

My guess would be that it is caching the password for future "session" authentication requests, not storing it in it's database.  As such, it is a variable that should accessible during the user session.

And no, AD will NOT return the password under any circumstances, it simply tells you if you have the right one or not.

Bunce wrote:

Its not coming from AD.  It can't. What mode did you have the auhentication module in? How exactly did you log into the website?

Gents,

I've been through this ad nauseum in the past few days, and I have a few ideas to offer.  Sorry, I know I'm a little late coming here.  I have been working to implement TTT.Authentication for DNN 2.1.2, so all the following relates to that version of the software as downloaded from Tam's site.

• The password is not being "retrieved" from AD, it is simply being confirmed by AD.  Tam's module asks AD if the password is correct, if it responds yes, then he can store the value you typed into DNN and "have your AD password."
• Since this was unacceptable I was able to change the code a bit to store a bogus password in DNN.  Then when I see an AD user logs in, his password will never match the bogus password and everything else will function as normal.  Works pretty well, actually.  The only disadvantage being that the "Password Reminder" feature is useless, so I had to hack the core to get rid of that option.
• The only problem we are now having is that IIS is somehow caching the passwords, so when an AD password is changed, the user can actually use both the old and new passwords (in DNN only, not on another computer where AD is used).  We've yet to resolve this little jewel.

Any thoughts?

Regards,
Jason