2

When I change the user passwords after upgrade for some users in the systems > permissions > users edit page and try to login, the passwords do not work.

Looked at the database admin_user and it seems when I change/save the new password that the salt is actually longer than the old passwords. The old salt character(1.7) count was always limited to two characters and the new ones are longer (1.9)

Old salt: :x7
New salt: :t2UMmbI

Old passwords work and continue to work but as soon as I change them in the backend, users cannot login.

Also I tried inserting md5 hash+salt passwords and that via SQL query and that seems to work with two character salt but not with longer ones.

I have checked the sessions, etc and the solutions involving sessions do not seem to have any affect on it.

Any help would be greatly appreciated.

2
  • 1
    You should not post your salt, make sure when you fix this that you change it
    – lloiacono
    Jun 9, 2015 at 8:58
  • 1
    Salts are given as public. They are not part of the password, but part of the defensive techniques to avoid pre calculating hashes en mass. Jun 9, 2015 at 9:07

2 Answers 2

2

With the help of Fabian Blechschmidt's comment above (who was very close in his answer), I was able to find the solution

The issue was that the Salt itself was too short i.e. getting truncated in the database. In Magento 1.7 the password structure is VARCHAR length = 40 and in Magento 1.8/1.9 VARCHAR length = 100. So something got mixed up in the migration which cut off the password upon save in the admin.

Another post on Reddit also pointed out the change in admin_user database structure: http://www.reddit.com/r/Magento/comments/1rndjj/did_ce18_change_the_way_magento_stores_hashed/

1

It looks like your password field is too short. The hash is 32 chars long, but yours is only 7. So something went wrong while updating your database.

\Mage_Admin_Model_User::HASH_SALT_LENGTH
const HASH_SALT_LENGTH = 32;

When the salt is too short, magento can not hash the given password with the right has, to get the correct hash to compare them correctly.

1
  • Thank you for your response. I only included the salt in the above example . The md5+salt length is 32 then the :salt. Jun 9, 2015 at 17:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.