Problem with vanillas HashMetod

thomasp

Hello,
my name is Thomas and i want to integrate Vanilla Forums into Boonex Dolphin instead of Orca Forum, because its bad. The Gateway is near ready in order to release, because i have one question right now.

How can i hash my passwords, so that vanilla can recognize and use it:
My code ist like this:

$iPwID
$cphashmetod = 'Vanilla';

$vpasswort = $aNewProfile['Password']; // catch password as cleartext
Password = 'Vanilla';
$hashinsert = md5($vanillasalt.$vpasswort);
echo "$hashinsert";

Whats going wrong?
Inserts in Table GDN_User

$hashinsert in: Password
Password in: HashMethod

I hope somebody knows a little bit more an is able to help me.
Thanks in Advantage
Thomas

businessdad

Perhaps I misunderstood the requirements, but, if Dolphin is managing the Users, then you are looking for a Single Sign On solution, such as JsConnect or ProxyConnect.

augustwu

@businessdad said:
Perhaps I misunderstood the requirements, but, if Dolphin is managing the Users, then you are looking for a Single Sign On solution, such as JsConnect or ProxyConnect.

x00

business dad is correct, you should find that easier to use a connect.

nevertheless

md5($vanillasalt.$vpasswort);

is comparable to django hash method vanilla has method is more complex phppass. You can put django in the HashMethod field you would seperate the parts with $

e.g. 'md5$'.$Salt.'$'.md5($Salt.$Password);

if you want to get a valid vanilla hash. It is like so

$PasswordHash = new Gdn_PasswordHash();
$Password = $PasswordHash->HashPassword($Password);

x00

btw it not recommended to use a fixed salt fro all users. This bad. Salts should be specific to the hashed password, which is why hashed passwords are often in multiple parts, which contain salt, pepper, hash algorithm, hash, etc.

This makes for a variable results, which is more secure. vanilla's hash method takes care of this.

thomasp

Hi,
Thank you everybody for the quick help and your hints. These are very helpful to me to understand the hashprocess right now.
Yes Dolphin should manage the user, but otherwise by creation of an account, the script should be create the user also in vanilla, also password and username.

By use of: "$passwordcatch = $aNewProfile['Password'];" i will catch the password in cleartext and with:

$PasswordHash = new Gdn_PasswordHash();
$PassinsertVN = $PasswordHash->HashPassword($passwordcatch);

i will try to store the password in vanillas Usertable but i does not work, nothing will be stored. Have i forgot someting or someting to include?

thank you
greets
Thomas

x00

how are you loading the framework?

Like we said if in doubt use of one of the SSO solutions. Look in the docs for details.

Passing around passwords is a way to create weakness in your security.

thomasp

Hi and thanks, is a SSO solution really necessary? I think its necessary when a user is logged in Dolphin also loged in in Vanilla at same time. In order to avoid weakness in the application i want only hash the catched password and store it otherwise in my database. Thank you Thomas

thomasp

Is this the right way to implement SSO? http://vanillaforums.org/docs/singlesignon

hgtonight

@thomasp said:
Is this the right way to implement SSO? http://vanillaforums.org/docs/singlesignon

I would definitely try it.

x00

SSO is about authenticating users, is saying that user is valid let them pass. The sessions are separate, but linked to the authentication. In jsConnect it is delayed till the last moment when they visit the forum and credential are checked, with ProxyConnect you can create session together. If you read the docs con see how to do that.