Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

what kind of hashing does umbraco use in its membership provider

Tags:

hash

umbraco

I need to move users off of Umbraco to another CMS and all their passwords are hashed. I'd like to prevent users from resetting their passwords and would like to implement the same hashing algorithm in the new CMS.

What hashing type does Umbraco use in its membership provider?

for example

"W477AMlLwwJQeAGlPZKiEILr8TA=" is the hash of "test"

I cannot use .net and will have to re-implement this hashing in javascript.

UPDATED WITH ANSWER:

//not sure why I can't use cryptojs's utf16LE function
//words = CryptoJS.enc.Utf16LE.parse("test");
//utf16 = CryptoJS.enc.Utf16LE.stringify("test");

function str2rstr_utf16le(input) {
  var output = [],
      i = 0,
      l = input.length;

  for (; l > i; ++i) {
    output[i] = String.fromCharCode(
      input.charCodeAt(i)        & 0xFF,
      (input.charCodeAt(i) >>> 8) & 0xFF
    );
  }

  return output.join('');
}

var pwd = str2rstr_utf16le("test");
var hash = CryptoJS.HmacSHA1(pwd, pwd);

var encodedPassword = CryptoJS.enc.Base64.stringify(hash);
alert(encodedPassword);
like image 463
MonkeyBonkey Avatar asked Jan 10 '13 03:01

MonkeyBonkey


People also ask

Where does umbraco store passwords?

Umbraco user passwords are stored it your Umbraco database in table umbracoUser, column userPassword but passwords here are hashed, so just putting a new value will not help. It requires hashed value, which you need to generate.

Which Hashing is best?

SHA-256: This hashing algorithm is a variant of the SHA2 hashing algorithm, recommended and approved by the National Institute of Standards and Technology (NIST). It generates a 256-bit hash value. Even if it's 30% slower than the previous algorithms, it's more complicated, thus, it's more secure.


2 Answers

To be more specific, it uses this particular class to hash the password. This should serve as a simple implementation example.

Like Martijn pointed out, though, Umbraco uses the standard provider model. As such, you can both access it easily via the abstract classes, and create your own implementation of a membership provider.

like image 80
Andrei Avatar answered Oct 21 '22 11:10

Andrei


Umbraco is using the ASP.NET Membership Provider model, meaning that all the abstract classes which are provided Out-Of-The-Box with ASP.NET are capable of accessing the Umbraco Member. Check this link for more information about the ASP.NET Membership provider.

like image 37
Martijn van der Put Avatar answered Oct 21 '22 09:10

Martijn van der Put