salting passwords from IDP to Database

Peter Schober peter.schober at univie.ac.at
Thu Feb 4 06:14:14 EST 2016


* Yasser Afifi <yasser at 3dissue.com> [2016-02-04 11:39]:
> But since it is not a good idea to store plain passwords, i want to add
> another column for a password salt. every user will have a randomly
> generated salt attached to his password for added security.

Whatever SQL statements you're writing to perform the authentication,
that's where you'd add the salting. Here's a full example of how to
do that using MySQL, from the SimpleSAMLphp documentation:
https://github.com/simplesamlphp/simplesamlphp/blob/master/modules/sqlauth/docs/sql.txt
-peter


More information about the users mailing list