Where and how are passwords stored in Magento?

Question

It would be a tremendous user experience bless to have a universal login across various apps of my website. For now, I have a storefront of Magento and a community of IPS board. And I'm trying to integrate them into one universal login for my users.

IPS board offers a variety of login methods and one of them is External Database that enables me to integrate it with an external database for user details.

Fantastic! So I can link IPS with Magento's database for unified user credentials.

However, thus far I can only find the email field that is customer_entity.email.

My questions are:

1. What is the password hash field (table.field) in Magento?
2. How does Magento generate password hash? MD5? SHA1? What is the salt (I guess it's different by installation but where can I find it)?

As you can see from the attached images, I need the details of where and how Magento stores password to enable IPS to use Magento's database as external database for user login details.

Attached:

Any idea or suggestion on how to get this done would be greatly appreciated!

Answer 1

Customer's password is stored in customer_entity_varchar, it is an eav attribute. You can't use IPB external database functionality. You should use Mage::getModel('customer/customer')->authenticate($logi, $password); to authenticate customers in your code.

Answer 2

You can find the encryption key in /app/etc/local.xml. I haven't looked at the user table but my guess would be the hash field is the encrypted password.

Encryption functionality is in Mage_Core_Model_Encryption so if you can gain access to Magento from your IPS board, you could do something similar to:

$password = 'whatever'; //your logic provides this password

require_once('app/Mage.php'); //path to your Magento app/Mage.php
Mage::app(); //we can now use magento functionality

$decrypted = Mage::getModel('core/encryption')->decrypt($password);

You'll need to work out where best to put this logic in order to integrate it, but it's a start at least.