ZfzUser Authentication Always fails

Question

I have implemented ZfcUser in my application. The problem is that the authentication always fails even if the password is correct.

I have digged into the problem. What I have noticed is that, the application retrieves password hash from the password and pass it to the Bcrypt verify method.

Here is the code from Zend

if (!$bcrypt->verify($credential, $userObject->getPassword())) {
    // Password does not match
    $e->setCode(AuthenticationResult::FAILURE_CREDENTIAL_INVALID)
      ->setMessages(array('Supplied credential is invalid.'));
    $this->setSatisfied(false);
    return false;
}

Now the bcrypt verify method works as follows.

public function verify($password, $hash)
{
    $result = crypt($password, $hash);
    return Utils::compareStrings($hash, $result);
}

my password is 'admin123', the generated hash saved for it in database is "$2y$14$9QsDD3.T3xwCnZsMsiBft.fwLewL.0L5pyViAJY0EbNz0ECIGDi5u"

but I see that it will never match, because the verify method uses the Hash value as salt. I am doing something wrong, or is there some bug in the framework/?

the code used to setup the password in my User Entity is

public function setPassword($password)
{
    $bcrypt = new Bcrypt();
    $bcrypt->setCost(14);
    $this->password = $bcrypt->create($password);
}

Possible duplicate of [Zend\Crypt\Password\BCrypt verify method](http://stackoverflow.com/questions/32717509/zend-crypt-password-bcrypt-verify-method) — Wilt, Nov 12 '15 at 14:15

score 0 · Answer 1 · edited May 23 '17 at 10:27

0

I asked exactly the same question here.

It turns out that crypt can use the hash. It will break it down in usable pieces and then it will use appropriate part of it as a salt, so there is no problem to pass whole hash as second parameter.

Did you actually try? Could it be that the problem is somewhere else.

edited May 23 '17 at 10:27

Community

1
1

answered Nov 12 '15 at 14:14

Wilt

41,477
12
152
203

Maybe then I am storing the password in wrong way in the database because the result hash is different from the password has in db. I have included the code in original post for password generation to save in database. Kindly have a look at it that it is correct. – S. A. Malik Nov 12 '15 at 14:35
@backTangent After you created the password immediately try: `$bcrypt->verify($password, $this->password);` – Wilt Nov 12 '15 at 15:08

ZfzUser Authentication Always fails

1 Answers1