Scotty, how does WLPE/MODx save the password to the database?

I thought of an idea. If I could use some sort of PHP/SQL command to "join" my forum and MODx databases together for just the username and password fields (as a start), I could "bridge" the two.

This would mean that the password would need to be encrypted in the same way, I’d imagine.

So I have two questions...

1) Is there a PHP/MySQL command that can "join" two databases together, or just two database fields (like if I moved MyBB’s fields to the MODx database, or vice-versa)? And if so, d they need to be the same name, or can the command join two differently named fields?

2) Any idea on what scheme is used in MODx/WLPE to "encrypt" the password (and in exchange, unencrypt it)?

In general, when integrating user systems, the password needs to remain encrypted in whatever format each native system expects it. MODx expects it currently in an MD5 hash, SMF uses it’s own algorithm, etc. What you need to be able to do is create an interface to help synchronize changes to the password; i.e. a central form to change password, which would update each repository using the appropriate encryption algorithm. In other words, put all your user administration in one place and have it update all sources.

If that is beyond the scope of what you want to do, the only other approach is to simply create an authentication plugin that will use the credentials and data from another database to populate the necessary session variables to "be authenticated" as a MODx user.

Unfortunately, it’s not as simply as just writing a SQL JOIN statement.

So, if MyBB happens to use MD5, the same as MODx, then I shouldn’t have much problems, save doing the command to join the fields so they get updated on either end?

I posted a topic on MyBB’s forums about it --- hopefully I’ll get a reply in a day or so.

It seems MyBB uses md5(salt.md5(plain_text_password)). Is that what MODx uses?

Quote from: Soshite at Oct 10, 2007, 08:38 PM

It seems MyBB uses md5(salt.md5(plain_text_password)). Is that what MODx uses?

MODx uses:

md5(’plain_text_password’);

Pixelchutes and I are finalizing the invokeEvent() timing and parameters so that making a plugin to hijack the form data onWebChangePassword() (or any WebLoginPE event) and then formatting that data into for use with a forum or any other script or database query will be so easy it will rock yer piratey socks off!

-sD-
Dr. Scotty Delicious, DFPA.

You mean like these, matey?

Quote from: OpenGeek at Oct 10, 2007, 07:06 PM

If that is beyond the scope of what you want to do, the only other approach is to simply create an authentication plugin that will use the credentials and data from another database to populate the necessary session variables to "be authenticated" as a MODx user.

http://openid.net

More @ the Wiki: http://en.wikipedia.org/wiki/OpenID

...Looks like SMF is already on-board for an OpenID implementation. We’ll see what SMF 2.0 has in store for us!

http://modxcms.com/forums/index.php/topic,13979.0.html

I noticed this snippet that was a OpenID version of WebLogin. Maybe what was done there could be implemented into WLPE? MyBB also has a plugin for OpenID, IIRC.

Hi,

I know this is an old topic, but I thought it probably useful to have past comments about this matter to hand.

I wondered if FEDERATED tables could be used to bridge SMF and MODX (to achieve what the original poster seemed to be seeking). Usually, these are used across servers, but there is nothing to stop this being used on a single server. The SMF membership would be moved to its own database, and the FEDERATED table will hold nothing but the connection information to link the two tables. This should work. But, if we took this further and created a similar FEDERATED link from the SMF membership table database and MODX, might this form the basis of a bridge, of sorts?

The SMF membership tables contain far more information that just membership names and passwords (unlike MODX), but I assume that is would not cause a problem for MODX.

Of course I realise that SMF and MODX use different password encryption. Is it (practically) possible to make changes to how passwords are stored in MODX? I have a forum with thousands of members, but I currently use the MODX installation alone - there are no accounts that would be messed up by a change to the encryption/password/membership data, so it is MODX that I would change (if practically possible).

Is there any value in this proposal?

Thanks.

The password is saved as a MD5 hash to the web_users table. This table has four fields ID (an auto-increment value that is generated automatically on saving a new user), username, password (MD5 hash) and cachepwd, which is used when changing passwords.

The rest of the web user’s profile data is in the web_users_attributes table, and with WebLoginPE also in the custom table you can specify (or WLPE’s default table if you don’t specify a table name).