Commented by: @dyemanov

Execute statement does not do magic, it works via the public Firebird API. So if this feature is going to be implemented, then anyone can steal the stored hash and use it to connect to the database instead of using the password. So what's the point?

Commented by: @AlexPeshkoff

If one can steal stored hash from the firebird server address space, he can steal a lot of other interesting things. So keeping passsword or it's hash in RAM on server is not security problem. But in FB3 there is no user password on server present in any form available for further auth - it's just not transfered from client, instead pair of session keys are generated on client and server, and that key's hashes are compared by server to check password correctness. I see the following ways to solve a problem with keeping plain passwords in SP:
- organize callback to client when execute statement is issued, letting secondary server validate password
- have a kind of trusted servers' group, in which security context from some server is trusted by others
But certainly not in 2.5 and sooner of all not in 3.0.

Commented by: @livius2

put your user name, pass and role in context variable and uese it in in execute statement

Commented by: @AlexPeshkoff

Karol, in fb3 server is missing user's password (or even it's hash)

Commented by: @livius2

But after you connect to server you can store from client app info about user, pass and role in context vars
and retrive it in any place you want for execute external statment
And you do not need to store it as plain text then in procedurę body :)

Commented by: Sean Leyne (seanleyne)

Karol,

That is one approach.

But it would be insecure -- it assumes that password value would not be exposed by the trace logging of database context variable values (I believe this is already supported or an pending feature request)

Commented by: @AlexPeshkoff

Not exactly like was requested by Vladimir - but the problem raised by him is solved.

Added recently sample of plugin ExtAuth makes it not needed to pass login/password in execute statement on external if this authentication plugin is installed on all servers involved in data exchange and key specific for that group of servers is set on all them. See ~/examples/extauth/INSTALL for further details.