Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

Use ASP.NET membership in PHP

I need to authenticate against an ASP.NET membership table in php. The membership api is configured to use a hashed password.

Can someone kindly give me the php to hash the password that came from a login form and compare it to the sql field?

I know the password that I'm passing in is correct, but it's not hashing the same.

private function Auth( $username, $password )
{
    // Hashed password in db
    $hash = $this->parent->_memberData['conv_password'];

    // password passed from form
    $bytes = mb_convert_encoding($password, 'UTF-7');       

    // Salt from db
    $salt = base64_decode($this->parent->_memberData['misc']);

    // hash password from form with salt
    $hashedpassword = base64_encode(sha1($salt . $bytes, true));

    // Test em out
    if ($hashedpassword == $hash)
    {
        $this->return_code = "SUCCESS";
        return true;
    }
    else
    {
        $this->return_code = "WRONG_AUTH";
        return false;
    }
}

UPDATE:

I've tried different encodings with same results. UTF-7, UTF-8, and UTF-16.

UPDATE: I've been battling this for a week now. Bounty coming right up...

Here's the .net code in the form of a unit test. The unit test works and the values are straight out of the database. What's the correct translation of this code to php?

public void EncodePassword()
        {
        string expected = "aP/mqBu3VkX+rIna42ramuosS3s=";
        string salt = "urIaGX0zd/oBRMDZjc1CKw==";
        string pass = "Comeonman";

        byte[] bytes = Encoding.Unicode.GetBytes(pass);
        byte[] numArray = Convert.FromBase64String(salt);
        byte[] numArray1 = new byte[(int)numArray.Length + (int)bytes.Length];
        byte[] numArray2 = null;
        Buffer.BlockCopy(numArray, 0, numArray1, 0, (int)numArray.Length);
        Buffer.BlockCopy(bytes, 0, numArray1, (int)numArray.Length, (int)bytes.Length);

            HashAlgorithm hashAlgorithm = HashAlgorithm.Create("SHA1");
            if (hashAlgorithm != null)
            {
                numArray2 = hashAlgorithm.ComputeHash(numArray1);
            }

        Assert.AreEqual(Convert.ToBase64String(numArray2), expected);
    }
like image 755
Darthg8r Avatar asked Feb 23 '12 05:02

Darthg8r


People also ask

How can I use ASP.NET Membership provider?

The ASP.NET membership provider is a feature that enables ASP.NET developers to create Web sites that allow users to create unique user name and password combinations. With this facility, any user can establish an account with the site, and sign in for exclusive access to the site and its services.

How can I use ASP.NET Membership in C#?

To create a user in our application by using ASP.NET Membership we need the following steps to complete this process. Step 1: Firstly, open visual studio, then go to File Menu and click New -> Web Site. Step 2: After open the new empty website and add a new item Login. aspx in Registration inside Solution Explorer.

What is membership class in asp net?

The Membership class is used in ASP.NET applications to validate user credentials and manage user settings such as passwords and email addresses. The Membership class can be used on its own, or in conjunction with the FormsAuthentication to create a complete system for authenticating users of a Web application or site.

What is membership in web config?

The membership element is a sub-element of the system. web section. You can enable ASP.NET Membership for an application by directly editing the Web. config file for that application, or you can use the Web Site Administration Tool, which provides a wizard-based interface.


1 Answers

$password = 'Comeonman';
$salt = base64_decode('urIaGX0zd/oBRMDZjc1CKw=='); 
$utf16Password = mb_convert_encoding($password, 'UTF-16LE', 'UTF-8');
echo base64_encode(sha1($salt.$utf16Password, true));
like image 128
Alex Avatar answered Oct 11 '22 13:10

Alex