LMSouq
moodle-core Open

Need help debugging a custom authentication plugin for Moodle

MI
miCRoSCoPiC_eaRthLinG
1 month ago
3 views
Problem Description
I'm trying to authenticate against the user db of my website (CMS based) and it uses a slightly different approach at storing hashed passwords. It uses a randomly generated salt for each user. The salt is stored in the user db along with the hashed passwords. Hence, direct field-mapped authentication (as the **External DB plugin** does) won't work for me. To start off, I just mirrored the DB plugin and modified the `user_login()` procedure to read the hashed password and the salt from the database and then hash the entered password again with the salt and match it up with the password in the database. Here's the code for my `user_login()` function function user_login($username, $password) { global $CFG; $textlib = textlib_get_instance(); $extusername = $textlib->convert(stripslashes($username), 'utf-8', $this->config->extencoding); $extpassword = $textlib->convert(stripslashes($password), 'utf-8', $this->config->extencoding); $authdb = $this->db_init(); // normal case: use external db for passwords // Get user data $sql = "SELECT * FROM {$this->config->table} WHERE {$this->config->fielduser} = '".$this->ext_addslashes($extusername)."' "; $authdb->SetFetchMode(ADODB_FETCH_ASSOC); // No DB Connection if ( !$rs = $authdb->Execute( $sql ) ) { $authdb->Close(); print_error('auth_dbcantconnect','auth'); return false; } // No records returned if( $rs->EOF ) { $rs->Close(); $authdb->Close(); return false; } // Get password $db_password = $rs->fields['user_password']; $salt = $rs->fields['user_salt']; // Close DB Conn $rs->Close(); $authdb->Close(); // Return match return sha1( $extpassword . $salt ) == $db_password; } But when I try to login, username / passwords corresponding to the website (CMS) database are failing. However, the password (for the same user) that was stored in Moodle earlier on (before I tried using this custom plugin) is getting me through. That means, either my authentication routine is failing or moodle's internal db based auth mechanism is taking precedence over it. I've enabled *ADODB debug mode* - but that isn't helping either. When I enable the debug output from Server settings, the error messages are being sent prior to the page headers. Thus the login page won't display at all. I have all other forms of authentication turned off (except for Manual which can't be turned off) and my own. Any ideas on how to solve this issue?

AI-Generated Solution

Powered by LMSouq AI · GPT-4.1-mini

✓ Solution Ready
Analyzing problem and generating solution…
Was this solution helpful?
Back to Knowledge Base