Thanks James, I have updated the password of one user in galaxy_user table with the new algorithm,
I also adjusted the function "new_secure_hash" in /lib/galaxy/util/hash_util.py in such a way that it returns
the new hash instead of sha1. Now I tried to login, it fails to get the account, I think there is something going
wrong in the password hash comparison. Can you please assit here.
+++ b/lib/galaxy/util/hash_util.py Thu May 02 14:33:07 2013 -0400
@@ -25,13 +25,60 @@
Returns either a sha1 hash object (if called with no arguments), or a
hexdigest of the sha1 hash of the argument `text_type`.
"""
+ import hashlib
+ from os import urandom
+ from base64 import b64encode, b64decode
+ from itertools import izip
+ from pbkdf2 import pbkdf2_bin
+
+ SALT_LENGTH = 12
+ KEY_LENGTH = 24
+ HASH_FUNCTION = 'sha256'
+ COST_FACTOR = 10000
+
if text_type:
+ #return sha1( text_type ).hexdigest()
+
+ sec_hash_1 = sha1( text_type ).hexdigest()
+
+ if isinstance(sec_hash_1, unicode):
+ sec_hash_1 = sec_hash_1.encode('utf-8')
+ salt = b64encode(urandom(SALT_LENGTH))
+
+ return 'PBKDF2${0}${1}${2}${3}'.format(
+ HASH_FUNCTION,
+ COST_FACTOR,
+ salt,
+ b64encode(pbkdf2_bin(sec_hash_1, salt, COST_FACTOR, KEY_LENGTH, getattr(hashlib, HASH_FUNCTION))))