Generate password hash

Question

I have an external application written in VB.NET that needs to add user accounts to a drupal database.

We tried posting to the /user/register but something is funky with that code and it is not working. I also considered using a RESTful API plugin but that has proven to be more work than we are capable of delivering on short notice.

Just when I figured we could:

1. Add a value to sequences table
2. Use that previous value as ID of next user

We now discover that we need some fancy smancy hashed password. I look into the code and see D7 uses sha512 but also some hashing salt -- which again is yet another drupal method which accepts the number or iterations to hash (or something to that effect).

If the VB app uses a sha512 on a password will this suffice with Drupal? Will uses be able to login?

Tips, comments, etc more than welcome :)

Alex

Answer 1

No - a simple sha512 wouldn't be the same because its lacking the "salt" added by Drupal that prevents the "ability to use pre-hashed lists of candidate passwords" against your database (among other things). Its a security improvement over D5/D6 where a simple md5 update query could reset a user's password.

You might get more mileage out of connecting to the password-hash.sh script (in the scripts folder of your Drupal installation) in your VB script using whatever the equivalent to PHP exec() is in VB..

Answer 2

I believe that you'd need to be SHA512 hashing the password WITH the same style salt(s) as used on the Drupal instance.

My reasoning is that Drupal uses the salt when checking the validity of passwords and if you're saving unsalted SHA512 passwords they won't decode correctly when Drupal uses the Salt.

It's worth a try certainly however you're right in your own deduction that using an API of some form would be a better method.

You should start by following the password creation process in the includes/password.inc file.

You may be able to make use of the password_hash.sh script in the Scripts folder to perform the heavy lifting or to get ideas on how to implement this.