Allow verification of imported user passwords using other Crypt schemes

Created on 26 January 2018, over 6 years ago
Updated 30 January 2023, over 1 year ago

Problem

  • Users, whose accounts (including passwords) were imported from another application, cannot log in to Drupal β€” even though their (Blowfish/Bcrypt) password encryption scheme is natively supported by PHP.

Proposed resolution

  1. When a password cannot be handled by Drupal's Phpass password scheme, verify it through all Crypt schemes supported by password_verify() in PHP Core, which is natively available since PHP 5.5.

Remaining tasks

  • Add unit/kernel tests to prove that the fallback works as expected.

User interface changes

– none –

API changes

– none –

Data model changes

– none –

✨ Feature request
Status

Closed: duplicate

Version

10.1 ✨

Component
User systemΒ  β†’

Last updated about 16 hours ago

Created by

πŸ‡©πŸ‡ͺGermany sun Karlsruhe

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.69.0 2024