Is it possible to authenticate a Sqlanywhere system user without creating a new database connection?

Question

In Sybase Sqlanywhere, system users are stored in sys.sysuser.

Here is an example row from the table, for the user 'dba' with the password 'sql'.

user_id 1
object_id 175
user_name 'DBA'
password 0x013819f1b5d5a9fd1ba98e5b999239277b6296bee4bc28653802cd103d50fa76141aef7500
login_policy_id 173
expire_password_on_login_policy_id 0
password_creation_time '2012-02-23 11:24:32.000'
failed_login_attempts 0
last_login_time '2012-06-27 17:33:00.000'

I want to know how the password is hashed, or if anybody knows of a procedure or function that can be called to authenticate a username password combination in Sqlanywhere.

Answer 1

Passwords in SQL Anywhere are hashed using the SHA-256 algorithm, but the exact method of doing this is unpublished. In version 16.0 or later, you can use the sa_verify_password() stored procedure to verify the password of the current user.

If you want to verify a password for a different user, or if you are using a server prior to v16, the only way to verify a password is to attempt a connection using that password.

Disclaimer: I work for Sybase in SQL Anywhere engineering.