Lizmap-web-client: Automating user/pass insertion in the DB

[jaitor1]

[Question]

I need to insert 300 user/passwords into lizmap database.

I can build the 300 insert SQLs and execute them in SQLite Browser but the password is stored encrypted in the db and I don't know how to automate de password encryption in the SQL.

Is there any other method to automate the creation of a lot records of user/passwords without having to use the lizmap interface one by one, which will be very slow?

[tudorbarascu]

You should just copy it encrypted. When the user enters the password, the system encrypts it, checks the encrypted pass with the one from the database and if they match.. it lets you in. At least that's how it usually goes (I haven't checked if in lizmap is the same but I would be surprised if it wouldn't be).

[rldhont]

@jaitor1 with which version do you want to do it ?

[jaitor1]

@laurentj @rldhont I am in Lizmap 2.12.3

[laurentj]

By default, the password are encrypted using the password_hash() function of php : password_hash($mypassword, PASSWORD_DEFAULT); (it uses the bcrypt algorithm)

Different solutions, depending what you have as password data (you didn't tell us if your passwords are already encrypted or not)

Your password are not already encrypted

I hope you are not in this case, else it means you have a critical security issue in your information system. Passwords, in any kind of applications, should never be stored as clear text, to avoid dramatic issues in case of security breaks in your applications..

Anyway, if you are in this case, you can create your INSERT queries, by applying the SHA1 function on password values:

INSERT INTO jlx_user ( login, password, .....) VALUES ('his_login', SHA1('his_password'), ....);

When the user log in into lizmap, the password will be re-hached with the password_hash function (which is more secure than SHA1)

Your password are already encrypted

You can insert directly your data:

INSERT INTO jlx_user ( login, password, .....) VALUES ('his_login', 'his_hached_password', ....);

Then, you should know what kind of algorithm encryption has been used to encrypt password : sha1? bcrypt? md5? other?
If it is sha1, you have finished.

If it is an other type of algorithm, you have to change the value of password_crypt_function into the Db section of the file lizmap/var/config/index/auth.coord.ini.php and lizmap/var/config/admin/auth.coord.ini.php.

[Db]
...
password_crypt_function = sha1

You should indicate the name of the PHP function that can be used to hash password, in order to verify passwords. The function will take only one argument : a password. For MD5, just indicate 'md5'. For an other encryption algorithm, see this documentation.

Like in the previous case, when the user log in into lizmap, the password will be re-hached with the password_hash function.