How we get username and password

[randhir]

Hi everyone

I want to get a list of all the Account Name and Password that is created using File -> Manage -> Security.is it possible by the script or any plugins?

thanks

[Vaughan]

You cannot. There is no function that returns such information: to do sou would be a serious security breach.

All you can do is script the creation and deletion of user accounts and store the usernames in a table. Storing passwords in a data table is NOT a good idea for security.

[Steven H. Blackwell]

Additionally, you cannot get the password because FileMaker Pro does not store passwords in the file.

Why do you want this information?

Steven

[liltbrockie]

Additionally, you cannot get the password because FileMaker Pro does not store passwords in the file.

Why do you want this information?

Steven

Where does it store the password then? (just out of interest!)

[Vaughan]

Good question!

 

The password is run through a one-way hash function, and the resulting hash of the password is stored.

 

Unlike encryption, hash functions have no corresponding un-hash function: they are designed specifically to be irreversible, so there is no way to work out what the original value was.

 

When the account is created in the file, FMP hashes the password and stores the hash. Whenever the password is subsequently entered into an authentication dialog, it is processed through the same has function and the hash results are then compared.

[Steven H. Blackwell]

Vaughan is correct. 

 

Still, what I'd like to hear was what was the purpose for collecting this information?  It may be that a need can be met in some other fashion.

 

Steven

[milanm]

I am having a similar need, i dont know if i should post a new topic or patch to this one.

My system is made in a way that all of the users, except the full priviledge administrator (which is me) enter with "defaultuser" username and defaultuser password automatically

When they enter the system they are prompt to import the username and password given to them by the administration manager (not FileMaker Pro developer or admin) and that login structure then works through the system. This is made like this so the admin manager could sort out what he/she wants employees to see without having to call the developer everytime she wants to change this.

Unfortunatily, it seams that this is making the system slow as many users use the same genuine username and password at the same time.

It would be very helpfull if i could automatically login users with the usernames and passwords given to them, then copy these details to a built in login system to work with already created files and tables. This way they would not have to login with the same username and password, and they would not have to import their login details twice neither. Just one genuine login that would copy over the system.

Now it is easy to Get ( AccountName ) and it would be possible to make an entering script that would define the password by each account name entered, then add new users as they come to that script. However, the most elegant solution would be if i could retrive the password directly from the users genuine input and continue with the system built in login script without users noticing that this is happening.

[Wim Decorte]

I am having a similar need, i dont know if i should post a new topic or patch to this one.

My system is made in a way that all of the users, except the full priviledge administrator (which is me) enter with "defaultuser" username and defaultuser password automatically

When they enter the system they are prompt to import the username and password given to them by the administration manager (not FileMaker Pro developer or admin) and that login structure then works through the system. This is made like this so the admin manager could sort out what he/she wants employees to see without having to call the developer everytime she wants to change this.

Unfortunatily, it seams that this is making the system slow as many users use the same genuine username and password at the same time.

It would be very helpfull if i could automatically login users with the usernames and passwords given to them, then copy these details to a built in login system to work with already created files and tables. This way they would not have to login with the same username and password, and they would not have to import their login details twice neither. Just one genuine login that would copy over the system.

Now it is easy to Get ( AccountName ) and it would be possible to make an entering script that would define the password by each account name entered, then add new users as they come to that script. However, the most elegant solution would be if i could retrive the password directly from the users genuine input and continue with the system built in login script without users noticing that this is happening.

 

You should be looking at External Authentication, which is there specifically for the scenario that you describe.

[mr_mike]

 

(This post may be more appropriate in the PHP area)

 

We've completed an FMP database that will serve several thousand users and are currently working on exposing a PHP web front end.  The first question we encountered is one of security - how to handle usernames and passwords in PHP.  Generating a site using the PHP Site Assistant offers a model that appears to pass the password as "clear text".

 

Is there a model or guidance regarding how to secure passwords in PHP in a FileMaker solution? 

[webko]

All data entry on forms on a non-encrypted connection passes the information as clear text from the client to the web server. You would need to move to a https connection to secure data over the wire...