What in the facebook API becomes the password_hash and salt when a user signs up and authenticates using facebook?
AI-generated summary
When using Facebook authentication, the password_hash and salt fields in the database are still populated. will_io initially questioned what values from the Facebook API correspond to these fields, but discovered that even when users sign up with Facebook, a password_hash and salt are still generated. fantasticfears and fantasticfears clarified that the password is not set by the user, but rather can be reset by the user through their settings page. pfaffman explained that a single account can authenticate against multiple mechanisms, including local password, Google, or Facebook, as long as the email is the same. Hyan confirmed this behavior and noted that users can log in using either their OAuth2 provider credentials or their local password, set through the reset password function.
They are remain empty.
I thought there was a portion of users who – if they have their facebook settings set a specific way – could possibly both authenticate using facebook and also set a password.
I think that’s my problem. Or I might have a different problem.
Either way I have a user with Facebook() as a login and a password_hash/salt in the db.
Edit: I just checked with a dummy facebook acct. A password_hash and salt are still being set at registration if I use facebook. So something on my end might be drastically wrong I just don’t know what.
I am not following.
It doesn’t matter at all. You don’t have chance to set password when using an OAuth services if they provide username and email.
The user can use their setting page to reset their password.
Users can authenticate against any of the available mechanisms. As long as the email is the same, a single account can authenticate against Google, Facebook, or a local password. Does that explain what you are seeing?
저도 같은 질문을 가지고 있었습니다. OAuth 제공자를 통해 가입한 계정에 대해 왜 password_hash(또는 salt)가 여전히 데이터베이스에 설정되어 있는 것일까요? (저는 Discourse OAuth2 Basic 플러그인을 사용하고 있습니다.) 제 실험 결과, OAuth2가 활성화되고 설정된 상태에서 "로컬 로그인 활성화"를 비활성화하지 않으면, 사용자가 설정 패널의 비밀번호 재설정 기능을 통해 설정한 로컬 비밀번호로 로그인할 수 있는 것으로 확인되었습니다. 또한 OAuth2 제공자 자격 증명으로도 로그인할 수 있습니다. pfaffman이 말한 대로 두 가지 메커니즘 모두 허용됩니다.
password_hash의 초기 원시 값(raw value)이 무엇인지 궁금합니다.