Hi. This is probably a stupid question, but we have been migrating our forum from XenForo over to Discourse. We have a backend server for authorization which involves connecting to the database and verifying credentials against the users table. XenForo’s bcrypt algorithm worked as expected, and wit…

Nevermind. I had to use the hex representation of the salt as the argument, not the decoded salt like I was doing in the post above. Now the hashes are equal.

Are you using the migrate password plugin?

No, at least not that I am aware of. are you talking about this?

[画像] polyzium: I tried various different implementations of PBKDF2 algorithm, but they all output the exact same (different from Discourse’s) hash. Have you tried openssl’s implementation? That’s what we use (you can see it in discourse/lib/pbkdf2.rb). As an example, after setting a user’s p…

We primarily used Go’s crypto/bcrypt implementation for Xenforo. The same hashes from various pbkdf2 algorithm implementations suggests me that Go possibly stores strings or casts strings to bytes in a somewhat different way. I’ll have to try that tomorrow (it’s late over here). If OpenSSL gives me…

Do you have a short example test case? E.g. if you use the info above, what do you get?

Sorry, I am currently not in a position to tell you as timezones are annoying. It’s very late out here and I could only do so next day.

I did as you asked. The password is swordfish#98765. Database entry: discourse=> SELECT password_hash, salt, password_algorithm FROM users WHERE id=1; password_hash | salt | password_algorithm -------------…

[画像] polyzium: the hex representation of the salt as the argument This was also my theory! I made the same mistake at first.

Discourse をアカウントプロバイダーとして使用し、PBKDF2 の問題

開発

polyzium 2023 年 12 月 5 日午後 11:07 3

いいえ、少なくとも私が知る限りではありません。これについて話していますか？

トピック		返信	表示
What hashing algorithm is used in discourse for hashing passwords? Support	2	2661	2018 年 4 月 17 日
Export password hashes in the PHC format Self-Hosting how-to	8	4635	2021 年 1 月 7 日
Adding SSO after many users already signed up -- how to migrate them? SSO	17	1653	2022 年 9 月 11 日
Password hash algorithm Development	9	1811	2021 年 5 月 14 日
Migrated password hashes support Plugin	34	12223	2026 年 6 月 2 日

Discourse をアカウントプロバイダーとして使用し、PBKDF2 の問題

関連トピック