ruby – Meteor使用bcrypt从其他服务器验证电子邮件/密码

我在哪里

>我有两个网站,都在同一个域上,都共享相同的MongoDB.
>一个是具有帐户密码的METEOR应用程序(使用bcrypt)
>另一个是RUBY ON RAILS-app,它使用devise(也使用bcrypt)进行身份验证.
>在这两个应用程序上,我可以单独注册和登录.

当我将来自Meteor的“bcrypt”字段的encrypted_pa??ssword传输(复制/粘贴)到Ruby的“encrypted_pa??ssword”并尝试登录时,我被拒绝了.它不起作用反之亦然.然后我在我的ruby应用程序中重新创建了流星应用程序的salting(SHA-256 plain-password-hashing,然后才进行比较).

(这里是meteor accounts-password源文件(https://github.com/meteor/meteor/blob/oplog-backlog-on-1.0.3.1/packages/accounts-password/password_server.js))

这是我的Ruby实现：

class BCryptSHA256Hasher < Hasher
  def initialize
    @algorithm = :bcrypt_sha256
    @cost = 10
    @digest = OpenSSL::Digest::SHA256.new
  end

  def salt
    BCrypt::Engine.generate_salt(@cost)
  end

  def get_password_string(password)
    @digest.digest(password) unless @digest.nil?
  end

  def encode(password,salt)
    password = get_password_string(password)
    hash = BCrypt::Engine.hash_secret(password,salt)
    return hash
  end

  def verify(password,encoded)
    password_digest = get_password_string(password)
    hash = BCrypt::Engine.hash_secret(password_digest,encoded)
    # password = "asdfasdf"
    # encoded  = "$2a$10$FqvtI7zNgmdWJJG1n9JwZewVYrzEn38JIxEGwmMviMsZsrCmYHqWm"
    # hash     = "$2a$10$FqvtI7zNgmdWJJG1n9JwZe22XU1hRDSNtHIrnYve9FbmjjqJCLhZi"
    # constant_time_comparison:
    constant_time_compare(encoded,hash)
  end

  def constant_time_compare(a,b)
    check = a.bytesize ^ b.bytesize
    a.bytes.zip(b.bytes) { |x,y| check |= x ^ y }
    check == 0
  end

end

这是一个有效的用户文档,将由两个服务器使用：

{
  "_id": "g4BPfpavJGGTNgJcE","authentication_token": "iZqmCsYS1Y9Xxh6t22-X","confirmed_at": new Date(1457963598783),"createdAt": new Date(1457963456581),"current_sign_in_at": new Date(1457966356123),"current_sign_in_ip": "127.0.0.1","email": "demo@demo.com","emails": [
    {
      "address": "demo@demo.com","verified": true
    }
  ],"encrypted_password": "$2a$10$7/PJw51HgXfzYJWpaBHGj.QoRCTl0E29X0ZYTZPQhLRo69DGi8Xou","failed_attempts": 0,"last_sign_in_at": new Date(1457966356123),"last_sign_in_ip": "127.0.0.1","profile": {
    "_id": ObjectId("56e6c1e7a54d7595e099da27"),"firstName": "asdf","lastName": "asdf"
  },"reset_password_sent_at": null,"reset_password_token": null,"services": {
    "_id": ObjectId("56e6c1e7a54d7595e099da28"),"password": {
      "bcrypt": "$2a$10$7/PJw51HgXfzYJWpaBHGj.QoRCTl0E29X0ZYTZPQhLRo69DGi8Xou"
    },"resume": {
      "loginTokens": [

      ]
    }
  },"sign_in_count": 1,"updated_at": new Date(1457966356127),"username": "mediatainment"
}