Login [ Auth->identify() ] always false on CakePHP 3

Question

I started using CakePHP 3 after a time using CakePHP 2 and I am having troubles to create the authentication login.

The new auth function $this->Auth->identify() always return false.

On the database, the password are encrypted perfect and the query who takes the user it's ok too.

My code:

AppController:

[...]
class AppController extends Controller{
    public function initialize(){
        $this->loadComponent('Flash');
        $this->loadComponent('Auth', [
            'loginRedirect' => [
                'controller' => 'Admin',
                'action' => 'index'
            ],
            'logoutRedirect' => [
                'controller' => 'Pages',
                'action' => 'display'
            ]
        ]);
    }

    public function beforeFilter(Event $event)
    {
        $this->Auth->allow(['display']);
    }
}

UserController:

[...]
class UsersController extends AppController{
    public function beforeFilter(Event $event)
    {
    parent::beforeFilter($event);
    $this->Auth->allow(['logout']);
    }
[...]
    public function login()
    {
        if ($this->request->is('post')) {
            $user = $this->Auth->identify();
            if ($user) {
                $this->Auth->setUser($user);
                return $this->redirect($this->Auth->redirectUrl());
            }
            $this->Flash->error(__('Invalid username or password, try again'));
        }
    }
[...]

User (Model Entity):

<?php
namespace App\Model\Entity;

use Cake\Auth\DefaultPasswordHasher;
use Cake\ORM\Entity;

class User extends Entity{
    protected $_accessible = [*];
    protected function _setPassword($password){
        return (new DefaultPasswordHasher)->hash($password);
    }
}

View:

<div class="users form">
<?= $this->Flash->render('auth') ?>
<?= $this->Form->create() ?>
    <fieldset>
        <legend><?= __('Please enter your username and password') ?></legend>
        <?= $this->Form->input('username') ?>
        <?= $this->Form->input('password') ?>
    </fieldset>
<?= $this->Form->button(__('Login')); ?>
<?= $this->Form->end() ?>
</div>

Answer 1

CakePHP3 uses a different hashing algorithm by default than 2 (bcrypt vs. SHA1), so you need to make your password length longer. Change your password field to VARCHAR(255) to be safe.

When CakePHP 3 tries to identify your in-memory hashed password from this->Auth->identify() vs. the hashed password in the database, it will never match because some characters are missing. Changing to 255 is more than needed, but can help future proof if an even more secure hash is used in the future. 255 is recommended because the the character count can be stored in one byte.

Answer 2

Solved: The type on database was less than required. Changed to varchar(255) and now works fine :)

Answer 3

I had the same issue. The Login [ Auth->identify() ] was not working for me. Changing password length in db will resolve the issue.

Answer 4

Hi share my snippets to Login Auth, all Testing is OK, in CakePHP 3.1, customs (Table + view login BootStrap 3 + SQL base + custom bootstrap.php for Spanish in Inflector::rules(*******))

All code in

https://bitbucket.org/snippets/eom/rLo49

Answer 5

I came out with a solution just by adding use Cake\Auth\DefaultPasswordHasher; and its following override method _setPassword.

Here is the change:

Model/table.php

<?php

use Cake\Auth\DefaultPasswordHasher;

// Somewhere in the class
protected function _setPassword($password) {
    return (new DefaultPasswordHasher)->hash($password);
}