How to fetch current user password from session variables

Previous topic

Developer

Next topic

Author	Message
Elena Ivanova	Saturday 23 August 2008 4:18:32 am Hello, I'm dealing with a small extension and I need to fetch the current user password in my php script. I tried with: $currentUser =& eZUser::currentUser(); $currentUserPass = $currentUser->attribute( "password_hash" ); but it doesn't work for me, because of using LDAP for user authentication. Can I fetch current user password from session variables in some way? Thanks.
Xavier Gouley	Monday 25 August 2008 2:52:53 am Hi, Just used the LDAP for user authentication, I can say that the password is not stored in eZpublish : When a user try to login, the login / password is sent to LDAP for authentication. If LDAP reply with a positive answer, the eZuser (in eZpublish) is logged in, and updated with such elements like First Name, Last Name, groups, but NO password is put in the eZuser. In fact, the password is encrypted in LDAP (for my case it is, but check your LDAP), so there is no possibilities to retrive password form LDAP (it is not really secure I think). The password is natively not stored in the session vars also. The only possibility you have is to implement you own login handler (copy the LDAP one, and modify it) to store password elsewhere (at this step, the password is not encrypted yet). But caution, for security reasons, you have to put it on the server side only ($_SESSION could be a good way, but keep an eye on other eZ extensions that can see it, in clear). Good luck. Xavier Gouley http://www.gxapplications.com/eng_blog/GX-Admin-s-Blog/
Elena Ivanova	Monday 25 August 2008 10:57:20 am Hello Xavier, Many thanks for your answer. >When a user try to login, the login / password is sent to LDAP for authentication. If LDAP reply with a positive answer, the eZuser (in eZpublish) is logged in... If I understand you correctly - in terms of LDAP it means that this positive answer from LDAP comes if this user is binded with his/her username&password. Am I right? Best regards, Elena

Author

Message

Elena Ivanova

Saturday 23 August 2008 4:18:32 am

Hello,

I'm dealing with a small extension and I need to fetch the current user password in my php script. I tried with:

$currentUser =& eZUser::currentUser();
$currentUserPass = $currentUser->attribute( "password_hash" );

but it doesn't work for me, because of using LDAP for user authentication.

Can I fetch current user password from session variables in some way?

Thanks.

Xavier Gouley

Monday 25 August 2008 2:52:53 am

Hi,

Just used the LDAP for user authentication, I can say that the password is not stored in eZpublish :

When a user try to login, the login / password is sent to LDAP for authentication. If LDAP reply with a positive answer, the eZuser (in eZpublish) is logged in, and updated with such elements like First Name, Last Name, groups, but NO password is put in the eZuser.

In fact, the password is encrypted in LDAP (for my case it is, but check your LDAP), so there is no possibilities to retrive password form LDAP (it is not really secure I think). The password is natively not stored in the session vars also.

The only possibility you have is to implement you own login handler (copy the LDAP one, and modify it) to store password elsewhere (at this step, the password is not encrypted yet). But caution, for security reasons, you have to put it on the server side only ($_SESSION could be a good way, but keep an eye on other eZ extensions that can see it, in clear).

Good luck.

Xavier Gouley
http://www.gxapplications.com/eng_blog/GX-Admin-s-Blog/

Elena Ivanova

Monday 25 August 2008 10:57:20 am

Hello Xavier,

Many thanks for your answer.

>When a user try to login, the login / password is sent to LDAP for authentication. If LDAP reply with a positive answer, the eZuser (in eZpublish) is logged in...

If I understand you correctly - in terms of LDAP it means that this positive answer from LDAP comes if this user is binded with his/her username&password. Am I right?

Best regards,
Elena

eZ debug

Timing:	Jan 18 2025 16:07:54
Script start
Timing:	Jan 18 2025 16:07:54
Module start 'layout'
Timing:	Jan 18 2025 16:07:54
Module start 'content'
Timing:	Jan 18 2025 16:07:55
Module end 'content'
Timing:	Jan 18 2025 16:07:55
Script end

Main resources:

Total runtime	0.5973 sec
Peak memory usage	4,096.0000 KB
Database Queries	57

Timing points:

Checkpoint	Start (sec)	Duration (sec)	Memory at start (KB)	Memory used (KB)
Script start	0.0000	0.0045	588.1719	152.6563
Module start 'layout'	0.0045	0.0026	740.8281	39.5078
Module start 'content'	0.0070	0.5887	780.3359	542.7344
Module end 'content'	0.5957	0.0016	1,323.0703	12.0938
Script end	0.5973		1,335.1641

Time accumulators:

Accumulator	Duration (sec)	Duration (%)	Count	Average (sec)
Ini load
Load cache	0.0032	0.5416	16	0.0002
Check MTime	0.0014	0.2305	16	0.0001
Mysql Total
Database connection	0.0006	0.0996	1	0.0006
Mysqli_queries	0.5442	91.1030	57	0.0095
Looping result	0.0005	0.0918	55	0.0000
Template Total	0.5701	95.4	2	0.2851
Template load	0.0023	0.3886	2	0.0012
Template processing	0.5678	95.0533	2	0.2839
Template load and register function	0.0001	0.0137	1	0.0001
states
state_id_array	0.0003	0.0501	1	0.0003
state_identifier_array	0.0008	0.1384	2	0.0004
Override
Cache load	0.0019	0.3260	26	0.0001
Sytem overhead
Fetch class attribute can translate value	0.0005	0.0869	2	0.0003
Fetch class attribute name	0.0012	0.1990	5	0.0002
XML
Image XML parsing	0.0017	0.2905	2	0.0009
class_abstraction
Instantiating content class attribute	0.0000	0.0023	6	0.0000
General
dbfile	0.0018	0.3017	22	0.0001
String conversion	0.0000	0.0008	4	0.0000
Note: percentages do not add up to 100% because some accumulators overlap

Templates used to render the page:

Usage	Requested template	Template	Template loaded
1	node/view/full.tpl	full/forum_topic.tpl	extension/sevenx/design/simple/override/templates/full/forum_topic.tpl
3	content/datatype/view/ezimage.tpl	<No override>	extension/sevenx/design/simple/templates/content/datatype/view/ezimage.tpl
3	content/datatype/view/ezxmltext.tpl	<No override>	extension/community_design/design/suncana/templates/content/datatype/view/ezxmltext.tpl
5	content/datatype/view/ezxmltags/paragraph.tpl	<No override>	extension/ezwebin/design/ezwebin/templates/content/datatype/view/ezxmltags/paragraph.tpl
1	content/datatype/view/ezxmltags/literal.tpl	<No override>	extension/community/design/standard/templates/content/datatype/view/ezxmltags/literal.tpl
1	content/datatype/view/ezxmltags/line.tpl	<No override>	design/standard/templates/content/datatype/view/ezxmltags/line.tpl
1	print_pagelayout.tpl	<No override>	extension/community/design/community/templates/print_pagelayout.tpl
Number of times templates used: 15 Number of unique templates used: 7

Time used to render debug report: 0.0001 secs