asp.net-membership - SQL 创建 .Net Membership Provider 用户

Question

我有一个 SQL 脚本，可以在我的数据库中创建用户。它使用.Net 成员资格存储过程。

此时一切正常。

唯一的问题是密码保存为明文。我应该在此处更改什么以使其加盐/加密(不确定此处使用什么术语)

GO

DECLARE @return_value int,
  @UserId uniqueidentifier


EXEC @return_value = [dbo].[aspnet_Membership_CreateUser]
  @ApplicationName = N'Theater',
  @UserName = N'sam.sosa',
  @Password = N'mypassword',
  @PasswordSalt = N'eyhKDP858wdrYHbBmFoQ6DXzFE1FB+RDP4ULrpoZXt6f',
  @Email = N'sam@Simple.com',
  @PasswordQuestion = N'Whats your favorite color',
  @PasswordAnswer = N'Fusia',
  @IsApproved = 1,
  @CurrentTimeUtc = '2010-03-03',
  @CreateDate = '2010-03-03',
  @UniqueEmail = 1,
  @PasswordFormat = 0,
  @UserId = @UserId OUTPUT

SELECT @UserId as N'@UserId'

SELECT 'Return Value' = @return_value

GO

谢谢!

Answer 1

在“哈希”密码存储模式的底层，它只是简单地计算:

SHA1(盐+密码)

Salt 以 Base64 编码存储，因此必须在与 (Unicode) 密码连接之前对其进行解码。最后将结果进行Base64编码存储。

以下(可怕的)SQL 将输出一个适当编码的值，该值可以替换您当前拥有的“mypassword”。您还必须将 @PasswordFormat 设置为 1 以指示密码以散列形式存储。

declare @salt nvarchar(128)
declare @password varbinary(256)
declare @input varbinary(512)
declare @hash varchar(64)

-- Change these values (@salt should be Base64 encoded)
set @salt = N'eyhKDP858wdrYHbBmFoQ6DXzFE1FB+RDP4ULrpoZXt6f'
set @password = convert(varbinary(256),N'mypassword')

set @input = hashbytes('sha1',cast('' as  xml).value('xs:base64Binary(sql:variable(''@salt''))','varbinary(256)') + @password)
set @hash = cast('' as xml).value('xs:base64Binary(xs:hexBinary(sql:variable(''@input'')))','varchar(64)')

-- @hash now contains a suitable password hash
-- Now create the user using the value of @salt as the salt, and the value of @hash as the password (with the @PasswordFormat set to 1)

DECLARE @return_value int, 
  @UserId uniqueidentifier 

EXEC @return_value = [dbo].[aspnet_Membership_CreateUser] 
  @ApplicationName = N'Theater', 
  @UserName = N'sam.sosa', 
  @Password = @hash, 
  @PasswordSalt = @salt, 
  @Email = N'sam@Simple.com', 
  @PasswordQuestion = N'Whats your favorite color', 
  @PasswordAnswer = N'Fusia', 
  @IsApproved = 1, 
  @CurrentTimeUtc = '2010-03-03', 
  @CreateDate = '2010-03-03', 
  @UniqueEmail = 1, 
  @PasswordFormat = 1, 
  @UserId = @UserId OUTPUT 

SELECT @UserId as N'@UserId' 

SELECT 'Return Value' = @return_value