My question is very simple. Why on Earth are there two separate calls for 
validating PM questions? There is a query to get the question(s) followed 
by what seems like another query to get the answer(s). The format requires 
the query to be in the form of:

select question, answer from table name where user=?

Fine. But if you are trying to randomly select a question with say a view 
or procedure, the functionality is effective broken because you cannot 
guarantee the question/answer pair will match. See below:

2018-02-24 12:26:56,529 DEBUG 
[org.springframework.jdbc.datasource.DataSourceUtils] - <Fetching JDBC 
Connection from DataSource>
2018-02-24 12:26:56,546 TRACE 
[org.springframework.jdbc.core.StatementCreatorUtils] - <Setting SQL 
statement parameter value: column index 1, parameter value [THEUSER], value 
class [java.lang.String], SQL type unknown>
2018-02-24 12:26:56,562 DEBUG 
[org.springframework.jdbc.datasource.DataSourceUtils] - <Returning JDBC 
Connection to DataSource>
2018-02-24 12:26:56,563 DEBUG 
[org.apereo.cas.pm.jdbc.JdbcPasswordManagementService] - <Found [1] 
security questions for [THEUSER]>

2018-02-24 12:26:59,489 DEBUG [org.springframework.jdbc.core.JdbcTemplate] 
- <Executing prepared SQL query>
2018-02-24 12:26:59,490 DEBUG [org.springframework.jdbc.core.JdbcTemplate] 
- <Executing prepared SQL statement [SELECT question,answer from 
GENERAL.vTestQA where userid=?]>
2018-02-24 12:26:59,490 DEBUG 
[org.springframework.jdbc.datasource.DataSourceUtils] - <Fetching JDBC 
Connection from DataSource>
2018-02-24 12:26:59,506 TRACE 
[org.springframework.jdbc.core.StatementCreatorUtils] - <Setting SQL 
statement parameter value: column index 1, parameter value [THEUSER], value 
class [java.lang.String], SQL type unknown>
2018-02-24 12:26:59,523 DEBUG 
[org.springframework.jdbc.datasource.DataSourceUtils] - <Returning JDBC 
Connection to DataSource>
2018-02-24 12:26:59,523 DEBUG 
[org.apereo.cas.pm.jdbc.JdbcPasswordManagementService] - <Found [1] 
security questions for [THEUSER]>


There is also the concern that the database is not required to return the 
values in the same order every time.

Bill

-- 
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
--- 
You received this message because you are subscribed to the Google Groups "CAS 
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to [email protected].
To view this discussion on the web visit 
https://groups.google.com/a/apereo.org/d/msgid/cas-user/6a6e6fab-f5c3-4c98-8a92-72079c0cc412%40apereo.org.

Reply via email to