Don't use hash to check if binding worked

[CarlSchwan]

using password_hash is expensive and should be used for hashing
passwords when saving them in the database. Here we just want to see if
the bind was already done with the given password.

Time spent on testing.nextcloud.com for password hashing 160ms:

[come-nc]

Maybe name it sum instead of hash and use a fast checksum method like sha instead?
I dislike storing the clear password in a random variable, it might cause problems down the road.

[come-nc]

Maybe name it sum instead of hash and use a fast checksum method like sha instead? I dislike storing the clear password in a random variable, it might cause problems down the road.

This sum could be of dn+prefix+pwd to test if the bind was with the same parameters in one comparison.

[CarlSchwan]

Maybe name it sum instead of hash and use a fast checksum method like sha instead? I dislike storing the clear password in a random variable, it might cause problems down the road.

I switched to an md5 hash instead. It's still quite useless in my opinion since the password is already accessible in clear from the app config database, so adding a hash to compare two strings is not required even if the string is confidential.

At least with md5, the hashing will be quite a bit faster.

[come-nc]

I switched to an md5 hash instead. It's still quite useless in my opinion since the password is already accessible in clear from the app config database, so adding a hash to compare two strings is not required even if the string is confidential.

Yeah I know we store the data but the idea is to not have it in too many variables to not encourage its use everywhere, and be able to track each use by looking at configuration reads.

[PVince81]

👍

[CarlSchwan]

/backport to stable23

[CarlSchwan]

/backport to stable22

[CarlSchwan]

/backport to stable24

[blizzz]

sha256 over md5 to be more robust against collisions