This week I was contacted regarding a problem where somebody had been working on a site built with Community Auth, but once they moved the site to the production server, they could no longer login.
I went through my normal debugging routine, and found that the hashed password from the database was not matching the hashed password from the login attempt. Because it is easy to tell when a password is hashed using bcrypt, it was easy to see that the production server was not using it. This means the production server was not running PHP 5.3+, but the development server was running PHP 5.3+.
So this morning I added a new constant, defined in config/constants.php.
PHP52_COMPATIBLE_PASSWORDS
Appropriate documentation was added to the configuration page of Community Auth’s documentation, but in short, if you are going to use a development server that is running PHP 5.3+, and the production server will not be PHP 5.3+, setting this constant to 1 will force the development server to hash passwords using PBKDF2.
I’d like to say thank you again to everyone who has provided feedback.
UPDATE SEP 15, 2012:
I’ve done some work on debugging for failed login attempts, and added some documentation on how to debug them. It should be super easy to debug login problems going forward, and if you’ve had problems with Community Auth in the past, perhaps you’ll now be able to figure out why.
With this work and some I did over the past few weeks, I’ve bumped the version up to 1.4.4. Isolated download is already available on Bitbucket.