My question is very simple. Why on Earth are there two separate calls for validating PM questions? There is a query to get the question(s) followed by what seems like another query to get the answer(s). The format requires the query to be in the form of:
Fine. But if you are trying to randomly select a question with say a view or procedure, the functionality is effective broken because you cannot guarantee the question/answer pair will match. See below:
2018-02-24 12:26:56,529 DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - <Fetching JDBC Connection from DataSource>
2018-02-24 12:26:56,546 TRACE [org.springframework.jdbc.core.StatementCreatorUtils] - <Setting SQL statement parameter value: column index 1, parameter value [THEUSER], value class [java.lang.String], SQL type unknown>
2018-02-24 12:26:56,562 DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - <Returning JDBC Connection to DataSource>
2018-02-24 12:26:56,563 DEBUG [org.apereo.cas.pm.jdbc.JdbcPasswordManagementService] - <Found [1] security questions for [THEUSER]>
2018-02-24 12:26:59,489 DEBUG [org.springframework.jdbc.core.JdbcTemplate] - <Executing prepared SQL query>
2018-02-24 12:26:59,490 DEBUG [org.springframework.jdbc.core.JdbcTemplate] - <Executing prepared SQL statement [SELECT question,answer from GENERAL.vTestQA where userid=?]>
2018-02-24 12:26:59,490 DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - <Fetching JDBC Connection from DataSource>
2018-02-24 12:26:59,506 TRACE [org.springframework.jdbc.core.StatementCreatorUtils] - <Setting SQL statement parameter value: column index 1, parameter value [THEUSER], value class [java.lang.String], SQL type unknown>
2018-02-24 12:26:59,523 DEBUG [org.springframework.jdbc.datasource.DataSourceUtils] - <Returning JDBC Connection to DataSource>
2018-02-24 12:26:59,523 DEBUG [org.apereo.cas.pm.jdbc.JdbcPasswordManagementService] - <Found [1] security questions for [THEUSER]>
There is also the concern that the database is not required to return the values in the same order every time.