title: Mentally trying to sort out password<->Db scheme - how is this usually done?
body: <p>Okay so my problem is this:
  Firstly, user access to the SQL database is controlled by windows authentication, but the app is doing a second check to set user privilege levels within the app.</p>
  
  <ol>
  <li>When I create a new user in my WinForm client App it asks for a password which I then hash with a random salt, these data are then stored in the users table of my SQL database thusly:</li>
  </ol>
  
  <p>users
  username, firstName, lastName, pHash, pSalt, accessLevel etc.</p>
  
  <ol>
  <li><p>When that user, in a later session, tries to log in he gives his password. I pull the salt out of the database and hash the given password.</p></li>
  <li><p>Now this is my problem: I'm obviously insecure if I pull the hash from the database and compare it with the computed hash locally. </p></li>
  </ol>
  
  <p>My App maintains a 'user' object that sets a flag for 'authenticated' and has a property that is set based on the 'accessLevel' column in the users table in the database. </p>
  
  <p>There must be a usual way of doing this - or is my answer, you need to be using the SQL Server access facilities to do this not trying to re-invent it in managed code?</p>