Question

Hello I’m trying to do a login with Symfony2 and database table with passwords in md5 with no salt field. I have a lot of users and I can’t change it.

The login seems to work fine when I send form with invalid email, it returns the message right “Bad credentials”. But when I send form with good email it says “The presented password is invalid.”

What’s wrong?

I config the firewall:

security:
    encoders:
        Usuari\BackendBundle\Entity\Usuari:
            algorithm: md5

Implement UserInterface in Usuari entity, with no salt

    public function getUsername()
    {
        return $this->email;
    }

    public function getSalt() { 
        return '';
    }

    public function getPassword()
    {
        return $this->clau;
    }

    public function getRoles()
    {
        return array('ROLE_ADMIN');
    }

    public function eraseCredentials() { }

    public function equals(UserInterface $user)
    {
        return $this->email === $user->getUsername();
    }

And security controlles at /login route:

namespace Mes\BackendBundle\Controller;

use Symfony\Bundle\FrameworkBundle\Controller\Controller;
use Symfony\Component\Security\Core\SecurityContext;


    class SecurityController extends Controller
    {
        public function loginAction()
        {
            $request = $this->getRequest();
            $session = $request->getSession();

            // get the login error if there is one
            if ($request->attributes->has(SecurityContext::AUTHENTICATION_ERROR)) {
                $error = $request->attributes->get(SecurityContext::AUTHENTICATION_ERROR);
            } else {
                $error = $session->get(SecurityContext::AUTHENTICATION_ERROR);
            }

            return $this->render('MeBackendBundle:Security:login.html.twig', array(
                // last username entered by the user
                'last_username' => $session->get(SecurityContext::LAST_USERNAME),
                'error'         => $error,
            ));
        }
    }
    ?>

Answer 1

Thomas, this solutions seems works fine, but it is more complex.

Finally I decide regenerate all passwords from database with other encode function and salt field. I will send an email to the all users with a link that allows these change his password