Can’t Login

Hey @julian45123,

Apologies for the delayed response. It’s been a busy week.

From looking at this the example you sent the solution is incredibly custom and uses an md5 hash as it’s core (not bcrypt).

When it ‘encrypts’ the password it is definitely doing it in a custom way. It appears to be hashing the typed in password then storing the a jumble of the hash where the second set of 16 characters are placed on the front and the first set at the back. It then uses a salt and a static key which is being used like a second salt.

You can still make this work with the plugin using a hook.
If you go to the FAQ and look at the exlog_hook_filter_authenticate_hash hook there’s some instruction in there about how to write your custom hashing algorithm.

Essentially you’ll have to replicate the logic that your custom setup uses to return true or false in the hook.

Hey Julian,

Looks like you’ve made a good start.

I’ve added in some suggested error logs to help you and also put a couple of comments in place that may help you debug. The comments are regarding:

• There’s 2 or 3 functions that you’re using that I’m not sure if they do or don’t exist on this server.
• At one point you store some data in a variable $hash, never use it then write straight back over the top of it.

Here’s the code with comments and logs:

function myExlogHashAuthenticator($password, $hashFromDatabase, $username, $externalUserData) {
    error_log('EXLOG START >>>>>>>>>>>>>>>>>>>');

    $hashedPassword = strtoupper(md5($password));
    $staticKey = 'houdini';

    error_log('EXLOG hashed PW');
    error_log(var_export($hashedPassword, true));

    //     Does this function exist in your wordpress install???
    $flashClientHash = getLoginHash($hashedPassword, $staticKey);

    error_log('EXLOG FLASH');
    error_log(var_export($flashClientHash, true));

    $datbasePassword = password_hash($flashClientHash, PASSWORD_DEFAULT, [ 'cost' => 12 ]);

    error_log('EXLOG $datbasePassword');
    error_log(var_export($datbasePassword, true));

    $password = md5($password);

    error_log('EXLOG password md5');
    error_log(var_export($password, true));
    
    //     YOU DON'T SEEM TO USE THIS DATA ANYWHERE AS YOU CHANCE IT's VALUE BELOW???
    $hash = substr($password, 16, 16) . substr($password, 0, 16);
    
    //     Does this function exist in your wordpress install???
    $hash = encryptPassword($password, false);
    $hash .= $staticKey;
    $hash .= 'Y(02.>\'H}t":E1';
    $hash = encryptPassword($hash);

    error_log('EXLOG Comparison Values?');
    error_log(var_export($hash, true));
    error_log(var_export($hashFromDatabase, true));
    
    error_log('EXLOG VALID PASSWORD?');
    error_log(var_export($hash == $hashFromDatabase, true));

    error_log('EXLOG END >>>>>>>>>>>>>>>>>>>');
    return $hash == $hashFromDatabase;
}
add_filter('exlog_hook_filter_authenticate_hash', 'myExlogHashAuthenticator', 10, 4);

Have a look at your error logs and then you can check to make sure your hook is running, and see what is happening at each stage so you can see what doesn’t match up with what is happening on your other server.

Let me know how you get on 🙂

Thanks,

Tom

Haven’t heard back from you for a while so I’m going to assume this is resolved.

If not, don’t hesitate to get back in contact and we’ll see what we can do 🙂

Thanks,

Tom 🙂