Error 500 in test

Hey @adailtonphp,

The likely problem is that you have not configured the correct hashing algorithm that the external database uses.

Find out exactly what it does.

If it does not use one of the out of the box hashing algorithms, you can use a plugin hook to replicate the hashing process on the external database.

You can find information about the exlog_hook_filter_authenticate_hash hook in the FAQ.

Here’s a copy of the information . . .
——————————–
You can use this hook to check if the password is correct in a custom way. For example, if you use a hashing algorithm not supported by the plugin by default.

This hook provides you with a range of different information:
– $password – the password that was typed in at the login screen
– $hashFromDatabase – the hash stored in the database
– $username – the username that was typed in in the login screen
– $externalUserData – the rest of the data retrieved from the external database for the user that was found

Returning true will authenticate the user and returning false will treat them as unauthorised.

The below example shows how you could use the filter:

function myExlogHashAuthenticator($password, $hashFromDatabase, $username, $externalUserData) {
    return password_verify($password, $hashFromDatabase);
}
add_filter('exlog_hook_filter_authenticate_hash', 'myExlogHashAuthenticator', 10, 4);

———————————–

I think I’ve answered your questions so I’m going to mark this as resolved.

I’m obviously still happy to answer questions though so feel free to keep messaging back if you have more questions about the plugin 🙂

Thanks,

Tom
🙂

Yep that should work fine.

I should flag at this point that not hashing your usernames passwords is a huge security vulnerability which you could be held liable for if the data was breached.

Can you confirm which database type you are using? SQL?

The next step to try is to add some logs in the main flow.

In external-login/login/authenticate.php you could add the following error logs:

$block_access_due_to_role = true;
        foreach ($roles as $role) {
            if ($role != EXLOG_ROLE_BLOCK_VALUE) {
                $block_access_due_to_role = false;
            }
        }
        error_log('-------------exlog authenticate start--------');

        // If a user was found
        if ($response) {
            error_log('-------------exlog has response --------');

            // If role is blocking user access
            if ($block_access_due_to_role) {
                error_log('-------------exlog has block access due to role --------');
                $user = new WP_Error('denied', __("You are not allowed access"));

                // If user was NOT authenticated
            } else if (!$response["authenticated"]) {
                error_log('-------------exlog not authenticated --------');

                $error_message = isset($response['error_message']) ? $response['error_message'] : "Invalid username or password";
                // User does not exist, send back an error message
                $user = new WP_Error('denied', __($error_message));

                // If user was authenticated
            } else if ($response["authenticated"]) {
                error_log('-------------exlog authenticated --------');

                // External user exists, try to load the user info from the WordPress user table
                $userobj = new WP_User();
                $user = $userobj->get_data_by('login', $response['wp_user_data']['username']); // Does not return a WP_User object 🙁
                $user = new WP_User($user ? $user->ID : NULL); // Attempt to load up the user with that ID

In external-login/login/validate_password.php you could add the following error logs:

function exlog_validate_password($password, $hash, $user_specific_salt) {
        $salt_method = exlog_get_option("external_login_option_db_salting_method");
        $algorithm = exlog_get_option("external_login_option_hash_algorithm");

        $hash = exlog_should_lowercase_hex_hash($algorithm, $hash);

        error_log('-------------exlog start--------');
        if ($algorithm == "none") {
            error_log('-----------V--exlog was correct--V------');
            error_log(var_export($password == $hash, true));
            return $password == $hash;
        } else if ($algorithm == "phpass") {

You can then check your php error logs to get a better idea of where the flow is coming back.

Feel free to let me know your findings.

IMPORTANT! If you add any logs that store passwords, make sure you don’t share them here and you delete those logs!

Thanks,

Tom

🙂

Hey @alin26,

This is a server error and is normally not related to the plugin itself.

I would encourage you to run the test and then check the logs on your WordPress server and your database for relevant errors.

If you can find a useful error, feel free to share it back here (making sure you redact any private information).

Thanks,

Tom 🙂