6

I have sitecore 9.1 and I added pipeline which add new hashing algorithm (pbkdf2 implementation from Zetetic team with 5000 iterations) to CryptoConfig and changed hashAlgorithmType to pbkdf2 in membership section of web.config as well. Changing of passwords from sitecore works well, and logging in with sitecore login works as well (sitecore-instance.sc/sitecore/login?rc=1), but it looks like Identity Server uses pbkdf2 with 10000 iterations (default settings for IdentityServer 3+), because login is failed with it (sitecore-instance.identityserver/account/login).

UPDATE: Actually, sitecore implementation uses identityserver-contrib-membership to work with membership provider under the hood, which has hardcoded implementation of SHA-1 algorithm - MembershipPasswordHasher. As I saw in documentation Sitecore provides possibility to replace class implementation with custom one for Sitecore Host plugins (Host plugin Configuration doc) , but I didn't find good example of this configuration.

So, how to configure identity server to use same algorithm as Membership provider from sitecore instance?

  • Does this help grantkillian.wordpress.com/2019/01/02/… ? – Marek Musielak Apr 8 at 14:02
  • Actually not, it patches app.settings, but sitecore 9.1 doesn't have any app.settings file in project structure. It uses compiled libraries. I will try to decompile sitecore libraries to figure out how to override this configuration – Mickey P Apr 8 at 14:18
  • 1
    For SHA512 there s a bug with public reference number 302092 and a hotfix available for Sitecore Identity Server 2.0.0 which supports SHA512. Contact Sitecore Support for the hotfix – andyp Jun 20 at 8:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.