0

after successfully switching the authentification mechanism in dovecot and roundcube from MD5 to SHA512-CRYPT, I struggle to get Horde to authentificate using custom SQL queries.

Setting $conf['auth']['params']['encryption'] = 'crypt-sha512'; does not help a lot.

Somehow, the hash which is returned by the \P placeholder seems to be truncated: It's much too short, equal to the output of crypt-sha256and apart from that does not even look correct. Needless to say, it does not match the hash in the database.

Googleing around did not really lead to an answer, so I depend on your knowledge. This guy seems to have an at least slightly similar setup and is getting sensible hashes.

Is this rather a php or a horde issue? Or is it just me?

2 Answers 2

1

Aaah. Ok. Found my mistake. For determining the password, I also need to alter the query as I have to remove the leading {SHA512-CRYPT}:

$conf['auth']['params']['query_getpw'] = 'SELECT SUBSTRING_INDEX(password,\'}\',-1) FROM virtual_users WHERE email = \L';

then

$conf['auth']['params']['query_auth'] = 'SELECT * FROM virtual_users WHERE email = \L AND password = concat(\'{SHA512-CRYPT}\',\P)';

works :)

0
$conf['auth']['params']['query_auth'] = 'SELECT * FROM virtual_users WHERE email = \L AND password = concat(\'{SHA512-CRYPT}\',ENCRYPT(\P, SUBSTRING_INDEX(`password`,\'}\',-1)))';

and

$conf['auth']['params']['encryption'] = 'plain';

seem to work for me. But I would rather prefer to have an SQL query without a plaintext password. We doesn't it work like intended in the first question?

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .