hvirring/simplesamlphp-sqlauthbcrypt — pull request #1 by chrislewis60 (2013-08-28 11:20:55+00:00)
Title: No separate salt

Hi hvirring, firstly thanks for setting up this BCrypt module - saved me loads of time! However, I did have to tweak it to get it to work with my setup so I'll just run through the justification and if you agree then feel free to pull the changes in. And just in case it makes a difference, I usually code in ruby/Rails and I'm trying to link up simplesamlphp with a database created by the Rails Devise plugin which uses BCrypt under the hood.

I eventually solved my issue by looking at this stack overflow question:
http://stackoverflow.com/questions/9321075/ruby-bcrypt-password-retrieval-in-php

It all centers around the fact that you had a separate password salt column defined. However, my understanding of BCrypt is that it enforces password salting by storing the salt as part of the password hash - therefore no separate salt column is required. So when someone logs in I've passed the password_hash to the crypt function and crypt is able to extract the relevant salt from inside the password_hash.

Feel free to comment.

Regards,

Chris.