keystone.common.password_hashing module¶
- keystone.common.password_hashing.check_password(password: str, hashed: str) bool[source]¶
Check that a plaintext password matches hashed.
hashpw returns the salt value concatenated with the actual hash value. It extracts the actual salt if this value is then passed as the salt.
- keystone.common.password_hashing.generate_partial_password_hash(password: str, salt: str) str[source]¶
Generates partial password hash for reporting purposes.
The generated password hash is base64 encoded, and max_chars of it are returned.
- keystone.common.password_hashing.hash_user_password(user)[source]¶
Hash a user dict’s password without modifying the passed-in dict.
- keystone.common.password_hashing.needs_rehash(hashed: str) bool[source]¶
Return True if the stored password hash should be upgraded.
A rehash is needed when the stored hash uses a different algorithm than the currently configured one, or when the stored hash was computed with a weaker work factor than the currently configured (or default) value. This applies to bcrypt, bcrypt_sha256, scrypt, and PBKDF2-SHA512.
Callers should rehash transparently on the next successful authentication.
- keystone.common.password_hashing.verify_length_and_trunc_password(password) bytes[source]¶
Verify and truncate the provided password to the max_password_length.
We also need to check that the configured password hashing algorithm does not silently truncate the password. For example, passlib.hash.bcrypt does this: https://passlib.readthedocs.io/en/stable/lib/passlib.hash.bcrypt.html#security-issues
