Is it possible to change the joomla user authentication algorithm

Question

Hi I'm doing initial research on changing the way joomla authenticates a user. I want to do this only for the frontend user and not the admin user.

WHY I want to do this? I'm importing a list of users from a different CMS which uses SHA2SALT and SHA1 hashing technique. I have to rewrite that system so that it uses joomla and the old users can utilize the existing passwords to login. I can make a feature where the have to change their password immediately after the first login on the new system.

I'm exploring my options of getting this done and I want to know the best way to achieve this. viz. whether I need to write code or if there are any 3rd party plugins to achieve this.

Would this be the best way to go ? https://docs.joomla.org/J3.x:Creating_an_Authentication_Plugin_for_Joomla

Answer 1

Looking in libraries\phpass\PasswordHash.php, there seem to be all the functions necessary, as well as comments at the top in the case of editing the files. I can't say that I've ever tried it, nor heard of anyone else trying it, but this appears to be the starting point.

Of course, writing an authentication plugin using your own algorithm is the way to go, and be sure to check for $app->isSite() or $app->isAdmin to determine whether or not you want to check it with your algorithm.

You'll want to order your plugin to execute before the Joomla authentication plugin so that when it is bypassed by yours, it will go on to try Joomlas. Also, if yours fails for a front-end user, I'm pretty sure it will go on to try Joomla's, so be sure to handle the failed authentication with more than just return false .- I would guess that you'd want to throw an exception.

Answer 2

There is a password plugin in Joomla which can help you Password Control