We have a requirement where we are creating an user generation page over internet for various vendors.

This was earlier done by our operations team on intranet. For each vendor to create a unique ID that was used for various purposes.

How can we authorize users accessing the registration page hosted over internet?

Note: We don't save the vendors data in our system as they keep changing frequently.

Edit 1: One way we have been discussing is to introduce a 4 eye check. This way once the user has registered, It can be approved by two individual(both internal users- which role will have this priviledge is yet to be decided). Once they have approved that the user reistered is legitimate, we can save his details and then use it for authenticating the user.

Since, the vendors keep changing regulary, we are planning to introduce a 30 days inactivity threshold, after which the vendors ID will be disabled.

Please let me know if this is correct or if there is a better way to do it

  • I don't really understand this question. It is impossible to authenticate somebody without having some kind of information which allows to distinguish between wrong and correct authentication. Such thing might be a password, the expected certificate for client certificate based authentication etc - but it needs to be something which is clearly associated with the user you are trying to authenticate. Also, is this about "Authorization" (allow someone to do something) or "Authentication" (know who the user is) or the combination of both (decide what the user can do based on who he is)? – Steffen Ullrich Apr 8 at 8:58
  • @Steffen: Its kind a both. We want to allow legitimate users to generate the userID. – pratik pattanaik Apr 9 at 6:02
  • But if you have no information about users than how do you know which users are there and what these users should be allowed to do? There must be some instance which decides what is a valid user and what can he do in the first place. – Steffen Ullrich Apr 9 at 6:06
  • @Steffen: I have Edited my post with a way that we have been trying to solve. Could you please check that and let me know if that would be the best approach. Here we introduce a 4 eye check before saving the vendors details for authentication. As for authorization, all the vendors can only fill the form and generate their ID. – pratik pattanaik Apr 9 at 6:18
  • Your edit says "-... we can save his details and then use it for authenticating the user" which clearly conflicts with your subject "... without storing user details". It is still not clear what you are trying to solve. Or maybe you have a different idea of what "user details" is - for me this is at least what is needed to authenticate the user. – Steffen Ullrich Apr 9 at 6:30

You can use a one-way encryption method to encrypt user data (i.e. username and password) and store the encrypted form on your server side. This way, no one can retrieve the data. To authenticate the user (i.e. during log in), you encrypt the password using the same algorithm and you can make sure that they both match. You can use one of the following encryption methods: SHA-1, Salted SHA-1, SHA-2, Salted SHA-2, MD5, or crypt. I would recommend bcrypt and you can also try scrypt.

Otherwise, if you want the user to be able to restore the encrypted data, then you need to use two way encrypting methods like AES where you can save the encrypted data on the server side, and restore it at the client site using the private key.

  • 1
    A "one-way encryption method" doesn't really make sense. Given your examples, you probably meant a (cryptographically secure) hash. Essentially, you're proposing to use the username and password together as a password, and SHA-1, salted SHA-1, SHA-2, salted SHA-2 and MD5 aren't suited for that purpose. Bcrypt and scrypt are made for that purpose (as is Argon2). – user2313067 Apr 8 at 16:00
  • @user304584: I guess this wont really help as using this we cant really determine if the users trying to access the portal are really legitimate. If both A and B are registering themselves and have a username and passowrd, they can both login and carryout the tasks. However, how do we ensure that its only A that gets access to the portal. Guess without having some sort of user data already present, it would be really difficult – pratik pattanaik Apr 9 at 6:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.