Magento Password encription and decryption

Question

We have 2 instances of Magento running on 2 servers.

Whenever a User is created on 1st instance, we need to replicate the same user on other instance.

Replication process works fine, however the newly created user on instance 2 is not able to login because the password doesn’t work. This is happening due to the security salt which is different on both the server.

Is there a way were we get the password during account creation and we can use the same during the data replication by decryption?

Process Used: We created some API to send the post data to the other server.Other server consumed the API and created a customer.

Answer 1

It should work in the way you described.

According to Magento source code I see:

$this->setPasswordHash($this->hashPassword($password));

And digging you reach the Mage_Core_Model_Encryption::getHash method:

    public function getHash($password, $salt = false)
    {
        if (is_integer($salt)) {
            $salt = $this->_helper->getRandomString($salt);
        }
        return $salt === false ? $this->hash($password) : $this->hash($salt . $password) . ':' . $salt;
    }

The $salt variable is not defined while setting the user password, so it is random and added to the hash password itself as the md5 hashing requires to avoid an easy decrypting.

So there is no direct reference to the randomly generated salt during the setup process that is used for other purposes AFAIK.

So, your method should work, I do not understand why it is not. You problem must be elsewhere.

I suggest you to track it down with a xdebug session to see where the authentication fails.