SQL Anywhere, distribute database user (how to replicate users and password to remote db)

[obrungot]

For a replicated database environment, what is the recommended approach to replicate database user, to ensure that a user created in a consolidated database, gets replicated to remote databases?

[VolkerBarth]

Late to the game: You may also consider this question from the SQL Anywhere Forum.

It basically uses the same (undocumented) approach as discussed here. 🙂

[obrungot]

Well, that table would then need to contain the password. I would really not do that. Is is possible to set the grant with a hashed string

GRANT CONNECT user1 identified by encrypted 'HASHED STRING'

If so, then I don't see the problem adding it to helper table.

[chris_keating]

Storing credentials plain text is certainly not something you would do in an implementation. One option using existing SQLA features would be to use ENCRYPT and DECRYPT functions on both the user id and password.

[obrungot]

Yes, but only encrypt/decrypt don't offer much security by itself. Is it not possible to grant with password string already hashed? Or must the hashing be performed by the database?

[chris_keating]

The only issue relates to the syntax you are proposing is undocumented and intended for use by the unload mechanism. As it is undocumented, there is no guarantee that the syntax will no be changed.

The password hash is SHA256. ENCRYPT offers several algorithm and format options.