December 24, 2012 at 5:09 am
Hi all,
I'm attempting (unsuccessfully) to reset a password, the issue is that the column with the passwords in is encrypted. I don't know what key was used to encrypt the data or the what the certificate is. Is there a way of resetting the password in one of the rows without these bits of info?
Ive attempted copying a password that i know to be correct from a different db into the password column but it doesn't work, I'm assuming this is due to the way I'm trying to update the password without encrypting it upon entry?
I also attempted setting the password to Null so that I could attempt to change the password on the environment login screen - again without success.
any suggestions?
Thanks
December 26, 2012 at 3:13 am
I'm attempting (unsuccessfully) to reset a password, the issue is that the column with the passwords in is encrypted. I don't know what key was used to encrypt the data or the what the certificate is. Is there a way of resetting the password in one of the rows without these bits of info?
No. Without the key that was used to encrypt the data you will not be able to unencrypt the data, which you would need to be able to do in order to read the old values. Even if you cannot read the old values you need the encryption key in order to encrypt the new values so that when the value gets unencrypted by whatever application it is supporting it is getting the value you expect it to see.
Is there not a way in the application the database is supporting to reset the password?
Joie Andrew
"Since 1982"
December 26, 2012 at 7:53 am
Where is the encrypted data being decrypted? Is all the encryption handled in the application or in the database?
_______________________________________________________________
Need help? Help us help you.
Read the article at http://www.sqlservercentral.com/articles/Best+Practices/61537/ for best practices on asking questions.
Need to split a string? Try Jeff Modens splitter http://www.sqlservercentral.com/articles/Tally+Table/72993/.
Cross Tabs and Pivots, Part 1 – Converting Rows to Columns - http://www.sqlservercentral.com/articles/T-SQL/63681/
Cross Tabs and Pivots, Part 2 - Dynamic Cross Tabs - http://www.sqlservercentral.com/articles/Crosstab/65048/
Understanding and Using APPLY (Part 1) - http://www.sqlservercentral.com/articles/APPLY/69953/
Understanding and Using APPLY (Part 2) - http://www.sqlservercentral.com/articles/APPLY/69954/
December 31, 2012 at 2:14 am
Joie Andrew - I don't think there's a way to reset the password from the application other than the change password option each user is given on the login page - unfortunately this requires the old password.
Sean Lange - I think the data is encrypted in the database rather than the application.
Sorry took a while to get back to you. Thanks for the quick responses especially over the holiday period. We have set up the user with another account so its not quite as urgent as it was, although the problem with the old username is still there.
December 31, 2012 at 2:20 am
Joie Andrew - I don't think there's a way to reset the password from the application other than the change password option each user is given on the login page - unfortunately this requires the old password.
So what you could try for future scenarios is something like this:
- Create a new user in the application and setup a known password
- Query for that user in the database
- Note the value of the encrypted password column for the known password
- If a user needs a password reset and does not know the password update that user record to have the password match what you set in step one
- Have the user reset their password in the application using the password you set in step one as the "old password"
Joie Andrew
"Since 1982"
December 31, 2012 at 2:59 am
I had tried to do that initially except I had naively used a known password from a different db which obviously used different encryption settings.
Thanks for the help! 😀
Viewing 6 posts - 1 through 5 (of 5 total)
You must be logged in to reply to this topic. Login to reply