1

I have an external application written in VB.NET that needs to add user accounts to a drupal database.

We tried posting to the /user/register but something is funky with that code and it is not working. I also considered using a RESTful API plugin but that has proven to be more work than we are capable of delivering on short notice.

Just when I figured we could:

  1. Add a value to sequences table
  2. Use that previous value as ID of next user

We now discover that we need some fancy smancy hashed password. I look into the code and see D7 uses sha512 but also some hashing salt -- which again is yet another drupal method which accepts the number or iterations to hash (or something to that effect).

If the VB app uses a sha512 on a password will this suffice with Drupal? Will uses be able to login?

Tips, comments, etc more than welcome :)

Alex

2

No - a simple sha512 wouldn't be the same because its lacking the "salt" added by Drupal that prevents the "ability to use pre-hashed lists of candidate passwords" against your database (among other things). Its a security improvement over D5/D6 where a simple md5 update query could reset a user's password.

You might get more mileage out of connecting to the password-hash.sh script (in the scripts folder of your Drupal installation) in your VB script using whatever the equivalent to PHP exec() is in VB..

  • That could work actually...but VB apps are running on different computers -- not always within our network so short of installing SSH...hmmmm What we have concluded thus far is we can add records without passwords or using a known password and forcing new registrants to change password on login – Alex.Barylski Aug 28 '13 at 16:48
0

I believe that you'd need to be SHA512 hashing the password WITH the same style salt(s) as used on the Drupal instance.

My reasoning is that Drupal uses the salt when checking the validity of passwords and if you're saving unsalted SHA512 passwords they won't decode correctly when Drupal uses the Salt.

It's worth a try certainly however you're right in your own deduction that using an API of some form would be a better method.

You should start by following the password creation process in the includes/password.inc file.

You may be able to make use of the password_hash.sh script in the Scripts folder to perform the heavy lifting or to get ideas on how to implement this.

  • Adding to sequences and users seems to work so far and has not broken any code as of yet (wait 3 weeks :p) Calling any Drupal API from VB.NET is far to complicated and unlikely as the D7 instance is running on a different Windows server -- at least not Linux :) – Alex.Barylski Aug 28 '13 at 15:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.