FOSUserBundle - how is password salt applied?

2
votes

For reasons I can't explain (NDA... and yeah, I know that sounds sketchy), I need to be able to log users into my system outside of the normal Symfony/FOSUserBundle login flow. In order to do this, I need to know how FOSUserBundle applies its salt to the plain password, and I haven't found it yet. So, a nudge in the right direction would be greatly appreciated.

My encoder is currently set as:

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: sha512
2
symfonyfosuserbundlesalt

2 Answers

3
votes

Your question can not get a precise answer because there is not only one encoder for passwords in Symfony. It mainly depends on the configuration you use but to give you the direct direction, you should take a look to the encoders located under the Symfony\Component\Security\Core\Encoder namespace and read the code. Then, you should understand how salt and password are combined together.

1
votes

You may be looking for this:

http://symfony.com/doc/current/book/security.html#determining-the-hashed-password

$factory = $this->get('security.encoder_factory');
$user = new Acme\UserBundle\Entity\User();   

$encoder = $factory->getEncoder($user);
$password = $encoder->encodePassword('plainpassword', $user->getSalt());
$user->setPassword($password);