Password Encrypt Event

I’m sure this has been suggested before. If it’s redundant because of some module/method I am unaware of please let me know.

Problem: synchronizing web users with the users in other applications, for example Zencart. Different systems store passwords in different ways, for example using salts, etc.

Idea: Replace calls to crypt with an event callback, allowing a module to modify how the password is encrypted before it is stored in the database

I’ve managed to synchronize Zencart users with MODx web users, but I had to hack the core, so now I have a problem upgrading MODx.

Andy

Future user integration solutions will a) not store passwords locally in MODx if the user originates from an external system. and b) will allow custom password encryption (among other variable configuration properties) for locally-owned users. So, the problem will be solved two-fold, by allowing custom password encryption, and by encouraging uni-directional user synchronization where authentication providers never have to share critical password information.

IMO, bi-directional synchronization approaches to user integration are to be avoided like the plague. There are much more elegant ways to deal with distributed authentication, including the use of emerging standards like OpenID or SAML.

Will custom password encryption for local users be in version 1.0? If so will it be possible to upgrade from 0.9.x to 1.0 or will they be radically different?

I agree about bi-directional syncing. That’s why I think MODx should be the flexible glue that ties other systems together (store, forum, etc.).

Andy

Quote from: ajayre at Sep 28, 2006, 02:59 PM

Will custom password encryption for local users be in version 1.0? If so will it be possible to upgrade from 0.9.x to 1.0 or will they be radically different?

Most likely it will be in 1.0, yes; it’s now on the plan anyway.
As for upgrades, there will definitely be 0.9.x to 1.0 upgrades, as well as migration guides to assist those that have hacked interim solutions into place that might not be able to be fully migrate their data (and/or code) via an automated process.

I worked out a way to solve the problem with modifying the core.

In OnBeforeWebLogin authenticate the user against the store/forum database by encrypting their password using the method used by the store/forum.
If not authenticated then set their MODx password to ’’ so the login fails.
If authenticated:
Add user to MODx web users if doesn’t exist so login succeeds
or update MODx web user with current password so login succeeds

Solves the problem of not modifying the core and uni-directional syncing.

Andy