unable to login using this plugin

Hey @agentmishra,

Of course I’ll let you know when I’m done 🙂

As said previously there’s something I need from you to assist me doing the work but I wasn’t clear about what I needed.

Could you please create a new user in your Blesta system with the password “password1”. Could you then send me the hash that is created in the users table so that I can test the solution locally for you.

I want to make sure that the example code I give you for External Login will correctly convert “password1” to the hash that your Blesta system creates.

Thanks,

Tom

Hey @agentmishra,

I’ve made some progress with this.

I’ve created the feature that will allow you to add your own custom authentication checking. The hook gives you:
– the password that the user typed in
– the hash from the database

It then allows you to check to see if that password is valid for that hash.

What I haven’t been able to get working is to make this work with Blestas hashing method.

The code that you will need to add to your functions.php file will look something like this:

function myExlogHashAuthenticator($password, $hashFromDatabase) {
    $hmacHashFromPassword = hash_hmac('sha256', $password, '?????????????');
    $resultAfterBcrypt = password_verify($hmacHashFromPassword, $hashFromDatabase);
    return $resultAfterBcrypt;
}
add_filter('exlog_hook_filter_authenticate_hash', 'myExlogHashAuthenticator', 10, 2);

However I do not know what the key that needs passing into the hash_hmac function. You can see I’ve currently added question marks in there.

This is something you’ll have to check with Blesta support.

I have not yet published the code that will make this code work but I thought you might like to start your enquiry with Blesta sooner rather than later.

If you wanted to do some initial testing with this feature before I release it, you can find the code here:
https://github.com/tbenyon/wordpress_external_login_plugin/tree/hashhook

I won’t mark this as resolved until I publish the feature in the next release.

Thanks,

Tom

You’re going to owe me a 5* review after this @agentmishra 😛

————————————
Dear Blesta support,

I need to be able to validate a user’s password from the database using an external system using PHP.

Given a function that receives the plain text password and the hash for the user stored in the database I am struggling to see how I can validate the password.

I believe it should look something like the following but I am unsure of the key that would need to be passed into the hash_hmac function (see this currently replaced with question marks:

function validatePasswordAgainstHash($password, $hashFromDatabase) {
    $hmacHashFromPassword = hash_hmac('sha256', $password, '?????????????');
    $resultAfterBcrypt = password_verify($hmacHashFromPassword, $hashFromDatabase);
    return $resultAfterBcrypt;
}

Am I close?

Thank you for your support.
——————————————–

You now need to work with them to get it working on your local code.

You can try running this function with their modifications and passing in the data you’ve given me and making sure it returns true. E.g.

function validatePasswordAgainstHash(
'$2y$12$37Vz4b3gvYtpfEoFfB2uyOvL7kt0gfnW.m.584aMqqaBADVA0YQiS',
'password'
) {
    $validated = // Whatever code they suggested here
    if ($validated) {
        error_log('Validated')
    } else {
        error_log('Not validated')
    }
    return $validated;
}

If you could write a review I’d be grateful.

Thanks,

Tom