Question

I have a User entity that contains the username, name and other non sensitive information.

During authentication, I need to query the password (hashed) and the password salt in order to do a hash comparison. Those two properties are not part of the model due to their sensitive nature.

How can I query those two properties in NHibernate without using CreateSQLQuery? I now that CreateSQLQuery works, but I was trying to find a non SQL way.

Answer 1

create a DTO that would be mapped to the same table as User, and will only be used for this purpose, and use that.
for example-

public class AuthUserDTO
{
   public virtual string Username {get; set;}
   public virtual string PasswordHash {get; set;}
   public virtual string Salt {get; set;}
}

all of your ‘regular’ methods would return a regular User object, except for GetUserForAuthentication that would return an AuthUserDTO.