6.4.4 – Authenticate with a lookup

The same-record decision

In this lesson, the evidence is an ID and password pair. The ID identifies the account being claimed; the password must be the password associated with that same account. This is why authentication is needed: the program should not grant access merely because an ID is known or because an unrelated password appears somewhere in the stored data.

One PLS-safe representation is a list of records. Each inner list is one record: field 0 stores the ID and field 1 stores the associated password.

The pair Iris8 and maple2 should grant access. The pair Iris8 and amber9 should not: both strings occur in the table, but they belong to different records. Matching both fields in one record is the decisive feature.

These invented readable values make the lookup visible; they are classroom data, not real accounts.

Validation checks an input against format or range rules. Authentication checks the claimed identity using stored evidence. An ID can have a valid format and still not exist. In this lesson, comparisons are case-sensitive and input is not stripped or converted. Stored IDs are unique and nonempty, stored passwords are nonempty, and a blank entered value must fail authentication. There is one attempt per run; no retry limit or password-format rule is requested.

Trace the lookup

The following complete program stores three fictional account records. Before reading the trace, predict the output for inputs Moss42 and orbit3.

accounts = [
    ["Cedar17", "tulip8"],
    ["Moss42", "orbit3"],
    ["River05", "cobalt6"]
]

entered_id = input("Enter ID: ")
entered_password = input("Enter password: ")

authenticated = False
index = 0

while (index < len(accounts)) and (authenticated == False):
    if (accounts[index][0] == entered_id) and (accounts[index][1] == entered_password):
        authenticated = True
    index = index + 1

if authenticated == True:
    print("Access granted")
else:
    print("Access denied")

authenticated is a Boolean state flag. It starts False because no record has matched yet. The loop inspects one record at a time and sets the flag to True only when both comparisons are true at the current index.

For inputs Moss42 and orbit3, the state changes are:

The next loop test is false because (authenticated == False) is now false. Only after leaving the loop does the program select and display the supplied output:

Access granted

A successful match ends this loop before later records are inspected. A wrong password or unknown ID exhausts the list without making authenticated true.

Debug a cross-account match

A plausible faulty design records an ID match and a password match separately. This complete program uses the same fictional records but contains that logic fault:

accounts = [
    ["Cedar17", "tulip8"],
    ["Moss42", "orbit3"],
    ["River05", "cobalt6"]
]

entered_id = input("Enter ID: ")
entered_password = input("Enter password: ")

id_matches = False
password_matches = False
index = 0

while index < len(accounts):
    if accounts[index][0] == entered_id:
        id_matches = True
    if accounts[index][1] == entered_password:
        password_matches = True
    index = index + 1

if (id_matches == True) and (password_matches == True):
    print("Access granted")
else:
    print("Access denied")

Use the precise test Moss42 and tulip8. At index 0, password_matches becomes True because tulip8 is present, even though the ID does not match that record. At index 1, id_matches becomes True because Moss42 is present. The final selection therefore grants access incorrectly: the two flags have lost the relationship between the fields.

The smallest effective correction is to replace the two flags and their loop with one authentication flag that is set only inside a same-record condition:

authenticated = False
index = 0

while (index < len(accounts)) and (authenticated == False):
    if (accounts[index][0] == entered_id) and (accounts[index][1] == entered_password):
        authenticated = True
    index = index + 1