patternsqlMinor
Should login id and password be stored in separate table
Viewed 0 times
storedloginseparatepasswordshouldandtable
Problem
I am working on my academic project. I have a table for employee records which have employee id, joining date, designation and other fields. I am trying to implement a scheme in which when record of employee is added first time in DB, a user name and temporary password will be generated so that New employee can use it to login in DB to see his details.
I need to ask if it is good practice to save login id and password in employee record table? Or should I store them separately, but then I think I can not generate temporary password and id at time of inserting employee data in DB.
Or is there any other way to implement this scheme?
Edit: I understand that I should never save clear text password in DB and should use salt/hash. However I am looking for a way that above task can be done in one action, i.e If I make a separate table for user id and password then how can I am able to enter employee details in employee table and generate user id / password for user and store in from separate table in one action.
I need to ask if it is good practice to save login id and password in employee record table? Or should I store them separately, but then I think I can not generate temporary password and id at time of inserting employee data in DB.
Or is there any other way to implement this scheme?
Edit: I understand that I should never save clear text password in DB and should use salt/hash. However I am looking for a way that above task can be done in one action, i.e If I make a separate table for user id and password then how can I am able to enter employee details in employee table and generate user id / password for user and store in from separate table in one action.
Solution
From a database design perspective, I generally suggest a separate table for authentication credentials. That table could include additional attributes that apply to the login itself rather than the employee (e.g. password expiration date) and avoid need to carry that baggage around on every employee table query.
Also, I strongly recommend you never store passwords used for application authentication in the database. Instead, store a salted password hash. That is more secure since clear the text password cannot be retrieved even if the database is compromised.
Also, I strongly recommend you never store passwords used for application authentication in the database. Instead, store a salted password hash. That is more secure since clear the text password cannot be retrieved even if the database is compromised.
Context
StackExchange Database Administrators Q#91054, answer score: 6
Revisions (0)
No revisions yet.