Allow verification of imported user passwords using other Crypt schemes

Created on 26 January 2018, almost 7 years ago
Updated 30 January 2023, almost 2 years ago

Problem

  • Users, whose accounts (including passwords) were imported from another application, cannot log in to Drupal — even though their (Blowfish/Bcrypt) password encryption scheme is natively supported by PHP.

Proposed resolution

  1. When a password cannot be handled by Drupal's Phpass password scheme, verify it through all Crypt schemes supported by password_verify() in PHP Core, which is natively available since PHP 5.5.

Remaining tasks

  • Add unit/kernel tests to prove that the fallback works as expected.

User interface changes

– none –

API changes

– none –

Data model changes

– none –

Feature request
Status

Closed: duplicate

Version

10.1

Component
User system 

Last updated 1 day ago

Created by

🇩🇪Germany sun Karlsruhe

Live updates comments and jobs are added and updated live.
Sign in to follow issues

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Production build 0.71.5 2024