tbenyon

This is just pseudocode but by using this hook, rather than use External Logins logic to validate if the password is correct, you do your own check.

In this case we use WordPress’ built in wp_authenticate() method to validate the password.

You could add additional logic to check to see if the user already exists is WordPress use one way of authenticating and if they do not exist use another way?

I have not tested this – just showing as example. I document this hook in the FAQ if you want to have a read.

function myExlogHashAuthenticator($password, $hashFromDatabase, $username, $externalUserData) {
    $authenticateResponse = wp_authenticate($username, $password);
    return !is_wp_error( $return )
}
add_filter('exlog_hook_filter_authenticate_hash', 'myExlogHashAuthenticator', 10, 4);

Happy to help more if you need more help 🙂

Marking as resolved as I’ve not heard back. Feel free to get back in contact here if you have any further questions 🙂

Thanks,

Tom

Marking as resolved as I’ve not heard back. Feel free to get back in contact here if you have any further questions 🙂

Thanks,

Tom

Hey @danfelbm,

I haven’t heard back for over a week so I presume you know what you’re doing now so I’ll mark this as resolved.

If you have any more questions though, don’t hesitate to come back to me and I’ll be more than happy to help. 🙂

Thanks,

Tom 🙂

Hi @sohom,

Apologies for the delayed response.

The basic answer is no, the plugin doesn’t support SSO.

The plugin does not support syncing or data or sessions. It simply allows a user to login to WordPress with a password hash stored in another platform.

If you want to achieve SSO that is a custom process that would require a chunk of development work.

It’s possible that you could use that plugin as part of that flow by tying into the available hook but there is a lot of work to be done on both systems.

I think I’ve answered your question so I’ll mark this as resolved.

However if you have any more questions, please don’t hesitate to get back in contact 🙂

Thanks,

Tom

Hey @joannabiava,

I don’t believe this is a problem with the plugin. You need to ensure your PHP install has the drivers required to communicate with Microsoft SQL Server.

https://www.microsoft.com/en-us/download/details.aspx?id=20098

I hope this helps 🙂

Let me know how you get on.

Thanks,

Tom 🙂

Hey Daniel,

This doesn’t look right unfortunately but it is a good start.

The goal here is not to return the hash but to validate if the password provided is correct.

Inevitably checking that the hash that you generate in this function, matches the hash that is stored in your database.

The salt is not $hashFromDatabase. It is something that will be unique to your external system. In some systems every user has their own salt (the most secure way of doing it) and in some systems there is one salt for all systems.

You’ll have to research your system to find out what it uses for salting passwords when hashing.

Your end solution will look something like this:

function myExlogHashAuthenticator($password, $hashFromDatabase, $username, $externalUserData) {
    return sha1(md5($password) . 'someSaltHere') === $hashFromDatabase;
}
add_filter('exlog_hook_filter_authenticate_hash', 'myExlogHashAuthenticator', 10, 4);

If you’re confused about what a salt is and this is not making sense I would strongly recommend this article:
https://martinfowler.com/articles/web-security-basics.html
Skip to the title: “Hash and Salt Your Users’ Passwords”

Hope this helps 🙂

• This reply was modified 6 years ago by tbenyon.

Hi @kader1303,

Although some users have contacted me privately by finding me on networking platforms, it is against the policy of the forum to share any contact details.

Happy to hear what you needed here though?