I’m looking to be able to use the stored password hashes from discourse in a htpassword file for another app. What password hashing algorithm does discourse use?

Sorry if I’m misunderstanding, but are you saying you want to effectively copy Discourse’s hashing algorithm to your own app so you can match the hashes your app generates against those stored by Discourse? Wouldn’t this require you to regularly sync the passwords from Discourse to your htpasswd file, handle salts that Discourse may or may not have now or in the future, and keep your implementation of the hashing algorithm in sync with Discourse’s algorithm forever? Again, sorry if I’m completely misunderstanding, but I had to ask for clarification for my own curiosity.

[תמונה] seanblue: but are you saying you want to effectively copy Discourse’s hashing algorithm to your own app so you can match the hashes your app generates against those stored by Discourse? Just for checking that a user name password is valid. A user supplies a username and password. We check that the supplied password is valid according to the hash from discourse. We won’t be generating any hashes.

[תמונה] csmu: We won’t be generating any hashes By “generates” I didn’t mean to store, but to validate the password is correct. I wonder if Discourse has SSO in the opposite direction so that people can sign into other apps using Discourse directly.

Yes, discourse is able to be authoritative for sign-in and this is the correct path @csmu - Attempting to duplicate the hashing method would mean your sign-in method will break every time it changes. It also wouldn’t account for users who don’t have a local password.

[תמונה] pfaffman: unable to read the source I am able to read the source once I find it. I went looking through the source - for user.password - and I concentrated mainly on the user_controller. Nothing jumped out at me. I’d appreciate any pointers on where to look. What would work for me for is to be able to validate a user / password through discourse without adding in a sso signin / login. Maybe through the api or a direct call to some ruby code.

Oh. Yeah. Rails only makes sense after you know where stuff is. Here’s this app/models/user.rb main (since_reply.count >= SiteSetting.newuser_max_replies_per_topic) end def delete_posts_in_batches(guardian, batch_size = 20) But I still recommend backing up and describing the problem rather than starting with your solution.

[תמונה] pfaffman: Rails only makes sense after you know where stuff is. Here’s this Thanks Jay - After reading def confirm_password?(password) return false unless password_hash && salt self.password_hash == hash_password(password, salt) end in user.rb the following works for straight ruby validation user = User.find_by_email('some.email.address') user.confirm_password?'valid-password' => true [תמונה] pfaffman: describing the problem rather than starting with your solution I was experimenting with a .htaccess file for a server and I was looking for a way to validate a username / password through discourse for that server without knowing the passwords to generate the .htaccess file. The SSO approach is better and knowing how to validate a user name / password without using SSO will be useful for me.

Hi, I’d be interested in knowing what password hash function and associated parameters (hash length, salt, what actual library is called) are used for local login. Looking at the ruby file mentioned earlier didn’t help me. I’m in need of this info for compliance purposes: best practices around GPDR (and in the general realm of systems security, really) require me to document this information. Edit: found the answer here: Export password hashes in the PHC format → discourse/docs/SECURITY.md at main · discourse/discourse · GitHub

Password hash algorithm

מפתח

pfaffman (Jay Pfaffman) 15 בספטמבר,‏ 2019,‏ 6:03pm 6

If you’re unwilling or unable to read the source to find the answer to your stated question, it might be best to take a step back and describe what problem you’re trying to solve.

נושא		תגובות	צפיות
Adding SSO after many users already signed up -- how to migrate them? SSO	17	2019	11 בספטמבר,‏ 2022
What hashing algorithm is used in discourse for hashing passwords? Product Support	2	2710	17 באפריל,‏ 2018
Using Discourse as an account provider and PBKDF2 problems Development	9	769	7 בדצמבר,‏ 2023
Export password hashes in the PHC format Self-Hosting how-to	8	4859	7 בינואר,‏ 2021
Reset password with custom ruby file Development	9	1035	27 בספטמבר,‏ 2023

Password hash algorithm

נושאים קשורים