Genexus Authentication without using Genexus Access manager

Question

I want to implement authentication in Genexus customly. Is there any way to implement authentication in component without enabling Genexus Access Manager(GAM)?

Answer 1

Of course you can manage by yourself and saving the encrypted passwords in your DB manually.

Answer 2

I suggest you store the passwords hashed and not encrypted for security according to OWASP Password Storage Cheat Sheet

Here is an example of how to hash with SHA512, but you can choose from all options in CryptoHash:

Parm(in:&PassWord, out:&HashSHA512);

&CryptoHash.Algorithm = CryptoHashAlgorithm.SHA512
&Digerido = &PassWord.Trim() // you can add salt here
for &i = 1 to 10 //number of iterations in hashing
    &Digerido = &CryptoHash.Compute(&Digerido)
endfor
&HashSHA512 = &Digerido.ToUpper()

So basically you use this proc to hash your password and store it in the database, and when the user logs in, you use the proc to get the hash and you compare the hash with the one stored in the database.