Method authUser

src/main/java/dbProcs/Getter.java:67–160

This method hashes the user submitted password and sends it to the database. The database does the rest of the work, including Brute Force prevention. @param userName The submitted user name to be used in authentication process @param password The submitted password in plain text to be used in authe

(String ApplicationRoot, String userName, String password)

	 */
	
	public static String[] authUser (String ApplicationRoot, String userName, String password)
	{
		String[] result = null;
		log.debug("$$$ Getter.authUser $$$");
		log.debug("userName = "  + userName);
		
		boolean userFound = false;
		boolean goOn = false;
		Connection conn = Database.getCoreConnection(ApplicationRoot);
		try 
		{
			//See if user Exists
			CallableStatement callstmt = conn.prepareCall("call userFind(?)");
			log.debug("Gathering userFind ResultSet");
			callstmt.setString(1, userName);
			ResultSet userFind = callstmt.executeQuery();
			log.debug("Opening Result Set from userFind");
			try
			{
				userFind.next();
				log.debug("User Found"); //User found if a row is in the database, this line will not work if the result set is empty
				userFound = true;
			}
			catch(Exception e)
			{
				log.debug("User did not exist");
				userFound = false;
			}
			if(userFound)
			{
				//Authenticate User
				callstmt = conn.prepareCall("call authUser(?, ?)");
				log.debug("Gathering authUser ResultSet");
				callstmt.setString(1, userName);
				callstmt.setString(2, password);
				ResultSet loginAttempt = callstmt.executeQuery();
				log.debug("Opening Result Set from authUser");
				try
				{
					loginAttempt.next();
					goOn = true; //Valid password for user submitted
				}
				catch (SQLException e)
				{
					//... Outer Catch has preference to this one for some reason... This code is never reached!
					// But I'll leave it here just in case. That includes the else block if goOn is false
					log.debug("Incorrect Credentials");
					goOn = false;
				}
				if(goOn)
				{
					//ResultSet Not Empty => Credentials Correct
					result = new String[5];
					result[0] = loginAttempt.getString(1); //Id
					result[1] = loginAttempt.getString(2); //userName
					result[2] = loginAttempt.getString(3); //role
					result[4] = loginAttempt.getString(6); //classId
					if (loginAttempt.getBoolean(5)) //Checking for temp password flag, if true, index View will prompt to change