I thought this would be transparent to the users instead of forcing
to reset the password.
Two thoughts... but please consider that I might not know what I am
talking about, and that these might not be good ideas ...
(1) James' implementation supports two hashing schemes in the table.
Co
Thanks James!
I have pulled the recent changes to my repository and this is working fine.
I have tested with creating a new user
and I tried to login with the recently created user and this works fine at
my end. The entry looks like as follows:
galaxy=# select username,email,password from galaxy_
Rather than committing this directly I created the following pull request:
https://bitbucket.org/galaxy/galaxy-central/pull-request/165/password-security-use-pbkdf2-scheme-with
It would be great if a couple of people could sign-off on it before
merging. I don't think I'm doing anything stupid,
Vipin, I think the main problem here is that you cannot treat PBKDF2
as a hash in this way. Every time you hash the same password you get a
different result because you are generating a new random salt.
Instead, you need to decode the in database representation to extract
the salt and then do a com
The only other relevant place is the User object in model/__init__.py
--
James Taylor, Assistant Professor, Biology/CS, Emory University
On Thu, May 2, 2013 at 6:46 PM, Vipin TS wrote:
> I have updated the table schema from the script to adjust the column length
> from the following script:
> l
I have updated the table schema from the script to adjust the column length
from the following script:
lib/galaxy/model/mapping.py
Now my new registration passwords are encrypted with second layer of
authentication using PBKDF2
new entry from the database table:
galaxy=# select username,email,pas
I have started testing with creating a new user and the password hash
created using new algorithm,
galaxy=# select username,email,password from galaxy_user where email = '
fml...@gmail.com';
username | email | password
--+--+-
Thanks James, I have updated the password of one user in galaxy_user table
with the new algorithm,
I also adjusted the function "new_secure_hash"
in /lib/galaxy/util/hash_util.py in such a way that it returns
the new hash instead of sha1. Now I tried to login, it fails to get the
account, I think t
That should be the only place, it is called from the some methods of
the User model object. So you could modify it to always hash new
passwords in a different way, but check old passwords with sha1 first,
then something else.
Although it might be nice to move the functionality into
security.valida
Hello dev-team,
I would like to add the different type of password encryption to the users
in my galaxy instance. I started working with the current password encoding
script:
/home/apps/galaxy-dist/lib/galaxy/util/hash_util.py
I will keep the current sha1 and add another layer of encryption to the
10 matches
Mail list logo