assert passwordEncryptedInDb.replace("{enc:1}","").decodeBase64()
==
passwordPlain.digest('md5').decodeHex()
And of course, we get the passwordEncryptedInDb value using
SELECT per.Password FROM Person per
JOIN Agent ag ON ag.PersonID = per.PersonID
WHERE ag.PeripheralNumber = @loginId
* non-SSO