Redmine

Hello everyone,

I dag a little into this tutorial:
http://www.redmine.org/projects/redmine/wiki/HowTo_to_handle_SVN_repositories_creation_and_access_control_with_Redmine

This - in theory - describes how I could do what it's title sais. However based on the current code it's just not possible.

Redmine currently stores the passwords in this format:

 The hashed password is stored in the following form: SHA1(salt + SHA1(password))

This is from the app/model/user.rb file

The SQL script that generates the VIEW which is later on used for the authentication is:

CREATE OR REPLACE VIEW ssh_users as
select login as username, hashed_password as password
from users
where status = 1;

The configuration for pam-ssh-auth:

password sufficient pam_mysql.so \
verbose=1 \
user=redmine_pam \
passwd=redmine_pam_pass \
host=localhost \
db=redmine \
table=ssh_users \
usercolumn=username \
passwdcolumn=password crypt=4

crypt 4 means SSH1 encryption...

Reading from the pam_mysql module's source code the SQL script that checks the password looks like this:

err = pam_mysql_format_string(ctx, &query,
        (ctx->where == NULL ?
            "SELECT %[passwdcolumn] FROM %[table] WHERE %[usercolumn] = '%s'":
            "SELECT %[passwdcolumn] FROM %[table] WHERE %[usercolumn] = '%s' AND (%S)"),
                1, user, ctx->where); 

The lines which do the actual checking:

case 4: {
#ifdef HAVE_PAM_MYSQL_SHA1_DATA
                    char buf[41];
                    pam_mysql_sha1_data((unsigned char*)passwd, strlen(passwd),
                            buf);
                    vresult = strcmp(row[0], buf);
                    {
                        char *p = buf - 1;
                        while (*(++p)) *p = '\0';
                    }
#else
                    syslog(LOG_AUTHPRIV | LOG_ERR, PAM_MYSQL_LOG_PREFIX "non-crypt()ish SHA1 hash is not supported in this build.");
#endif
                }

This would result in an SQL script like: SELECT password FROM ssh_users WHERE username = 'username';
The desired SQL statement would be: SELECT SHA1) ) as `password` FROM ssh_users WHERE username = 'username'

This all means one thing: no matter what you do, there is just no way you can generate a config with which you can somehow get the "SHA1)" format...
It would require you to recompile pam_mysql module just to support redmine.

Any tips/workarounds on how to solve this problem?