Authenticate Hashed password from My Java Swing Application

[Stanley Mungai]

HI Guys I have Built a Java Swing Application that Connects to a Database, I have Been Using Mysql But I have Changed to Oracle 11g and Now I am facing Problems authanticating user Log in from the Aplication. I have Hashed the Password using this Procedure:

CREATE OR REPLACE procedure MUNGAI.p_auth_insert_user (par_username in varchar2,
                                  par_password in varchar2,
                                  par_work in varchar2
                                 )
      is
        l_hash raw(2000);
      begin
        l_hash :=
         dbms_crypto.hash
           (utl_i18n.string_to_raw (par_password || par_work || upper(par_username),
                                    'AL32UTF8'
                                   ),
            dbms_crypto.hash_sh1
           );
 
      insert into user_login_table
        (user_name, p_word, work_class)
         values
        (par_username, l_hash, par_work);
     end p_auth_insert_user;
/

I Insert into the Database from the Java Application Using the Query:

exec  MUNGAI.p_auth_insert_user('USERNAME', 'Password', 'WorkClass');

My Problem is that when the user Logs in Using the Correct Credentials the login fails. Initially While I was Using MYSQL I Used:

select * from user_login_table where user_name = 'username' and Pass_word = SHA1('password');

Am looking for the best way to authenticate user login from My swing App.

[Campbell Ritchie]

Stanley Mungai wrote:HI Guys I have Built a Java Swing Application that Connects to a Database, I have Been Using Mysql But I have Changed to Oracle 11g and Now I am facing Problems authanticating user Log in from the Aplication. I have Hashed the Password using this Procedure:

CREATE OR REPLACE procedure MUNGAI.p_auth_insert_user (par_username in varchar2,
                                  par_password in varchar2,
                                  par_work in varchar2
                                 )
      is
        l_hash raw(2000);
      begin
        l_hash :=
         dbms_crypto.hash
           (utl_i18n.string_to_raw (par_password || par_work || upper(par_username),
                                    'AL32UTF8'
                                   ),
            dbms_crypto.hash_sh1
           );
 
      insert into user_login_table
        (user_name, p_word, work_class)
         values
        (par_username, l_hash, par_work);
     end p_auth_insert_user;
/

I Insert into the Database from the Java Application Using the Query:

exec  MUNGAI.p_auth_insert_user('USERNAME', 'Password', 'WorkClass');

My Problem is that when the user Logs in Using the Correct Credentials the login fails. Initially While I was Using MYSQL I Used:

select * from user_login_table where user_name = 'username' and Pass_word = SHA1('password');

Am looking for the best way to authenticate user login from My swing App.

Why are you doing the hashing in your application rather than letting the databases do it?

[Stanley Mungai]

NO Ritchie, The hashing is Happening from the database. When Creating a New User from Swing Application, the query:

exec  MUNGAI.p_auth_insert_user('USERNAME', 'Password', 'WorkClass');

is executed that Calls the Procedure above to Hash the password so that the database users are not able to view it.

[Campbell Ritchie]

What is wrong with the password() function?

I think this discussion is more suited to a databases forum, so I shall move it.