wamo/gnu-social
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

[AuthCrypt] Update README and fix formatting

Browse Source
This commit is contained in:
Diogo Cordeiro 2020-07-25 17:42:46 +01:00 committed by Diogo Peralta Cordeiro
parent 360fc0262b
commit c85feeaa1f
4 changed files with 184 additions and 213 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

186
lib/modules/AuthenticationModule.php
View File

@ -1,42 +1,36 @@
<?php <?php
// This file is part of GNU social - https://www.gnu.org/software/social
//
// GNU social is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// GNU social is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with GNU social. If not, see <http://www.gnu.org/licenses/>.
/** /**
* StatusNet, the distributed open-source microblogging tool
*
* Superclass for plugins that do authentication and/or authorization * Superclass for plugins that do authentication and/or authorization
* *
* PHP version 5
*
* LICENCE: This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @category Plugin * @category Plugin
* @package StatusNet * @package GNUsocial
*
* @author Craig Andrews <candrews@integralblue.com> * @author Craig Andrews <candrews@integralblue.com>
* @copyright 2009 Free Software Foundation, Inc http://www.fsf.org * @copyright 2009 Free Software Foundation, Inc http://www.fsf.org
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @link http://status.net/
*/ */
if (!defined('GNUSOCIAL')) { exit(1); } defined('GNUSOCIAL') || die;
/** /**
* Superclass for plugins that do authentication * Superclass for plugins that do authentication
* *
* @category Module * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @package GNUsocial
* @author Craig Andrews <candrews@integralblue.com>
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0
* @link http://status.net/
*/ */
abstract class AuthenticationModule extends Module abstract class AuthenticationModule extends Module
{ {
@ -47,19 +41,21 @@ abstract class AuthenticationModule extends Module
public $autoregistration = false; public $autoregistration = false;
//can the user change their email address //can the user change their email address
public $password_changeable=true; public $password_changeable = true;
//unique name for this authentication provider //unique name for this authentication provider
public $provider_name; public $provider_name = null;
//------------Auth plugin should implement some (or all) of these methods------------\\ //------------Auth plugin should implement some (or all) of these methods------------\\
/** /**
* Check if a nickname/password combination is valid * Check if a nickname/password combination is valid
* @param username *
* @param password * @param string $username
* @return boolean true if the credentials are valid, false if they are invalid. * @param string $password
*
* @return bool true if the credentials are valid, false if they are invalid.
*/ */
function checkPassword($username, $password) public function checkPassword($username, $password)
{ {
return false; return false;
} }
@ -67,16 +63,18 @@ abstract class AuthenticationModule extends Module
/** /**
* Automatically register a user when they attempt to login with valid credentials. * Automatically register a user when they attempt to login with valid credentials.
* User::register($data) is a very useful method for this implementation * User::register($data) is a very useful method for this implementation
* @param username username (that is used to login and find the user in the authentication provider) of the user to be registered *
* @param nickname nickname of the user in the SN system. If nickname is null, then set nickname = username * @param string $username username (that is used to login and find the user in the authentication provider) of the user to be registered
* @param null|string $nickname nickname of the user in the SN system. If nickname is null, then set nickname = username
*
* @return mixed instance of User, or false (if user couldn't be created) * @return mixed instance of User, or false (if user couldn't be created)
*/ */
function autoRegister($username, $nickname = null) public function autoRegister($username, $nickname = null)
{ {
if(is_null($nickname)){ if (is_null($nickname)) {
$nickname = $username; $nickname = $username;
} }
$registration_data = array(); $registration_data = [];
$registration_data['nickname'] = $nickname; $registration_data['nickname'] = $nickname;
return User::register($registration_data); return User::register($registration_data);
} }
@ -84,12 +82,14 @@ abstract class AuthenticationModule extends Module
/** /**
* Change a user's password * Change a user's password
* The old password has been verified to be valid by this plugin before this call is made * The old password has been verified to be valid by this plugin before this call is made
* @param username *
* @param oldpassword * @param string $username
* @param newpassword * @param string $oldpassword
* @return boolean true if the password was changed, false if password changing failed for some reason * @param string $newpassword
*
* @return bool true if the password was changed, false if password changing failed for some reason
*/ */
function changePassword($username,$oldpassword,$newpassword) public function changePassword($username, $oldpassword, $newpassword)
{ {
return false; return false;
} }
@ -101,136 +101,141 @@ abstract class AuthenticationModule extends Module
* nice looking nicknames when users initially sign on * nice looking nicknames when users initially sign on
* All nicknames returned by this function should be valid * All nicknames returned by this function should be valid
* implementations may want to use common_nicknamize() to ensure validity * implementations may want to use common_nicknamize() to ensure validity
* @param username *
* @param string $username
*
* @return string nickname * @return string nickname
*/ */
function suggestNicknameForUsername($username) public function suggestNicknameForUsername($username)
{ {
return common_nicknamize($username); return common_nicknamize($username);
} }
//------------Below are the methods that connect StatusNet to the implementing Auth plugin------------\\ //------------Below are the methods that connect StatusNet to the implementing Auth plugin------------\\
function onInitializePlugin(){ public function onInitializePlugin()
if(!isset($this->provider_name)){ {
throw new Exception("must specify a provider_name for this authentication provider"); if (is_null($this->provider_name)) {
throw new Exception('must specify a provider_name for this authentication provider');
} }
} }
/** /**
* Internal AutoRegister event handler * Internal AutoRegister event handler
* @param nickname *
* @param provider_name * @param string $nickname
* @param user - the newly registered user * @param string $provider_name
* @param User $user - the newly registered user
*/ */
function onAutoRegister($nickname, $provider_name, &$user) public function onAutoRegister($nickname, $provider_name, &$user)
{ {
if($provider_name == $this->provider_name && $this->autoregistration){ if ($provider_name == $this->provider_name && $this->autoregistration) {
$suggested_nickname = $this->suggestNicknameForUsername($nickname); $suggested_nickname = $this->suggestNicknameForUsername($nickname);
$test_user = User::getKV('nickname', $suggested_nickname); $test_user = User::getKV('nickname', $suggested_nickname);
if($test_user) { if ($test_user) {
//someone already exists with the suggested nickname, so used the passed nickname //someone already exists with the suggested nickname, so used the passed nickname
$suggested_nickname = common_nicknamize($nickname); $suggested_nickname = common_nicknamize($nickname);
} }
$test_user = User::getKV('nickname', $suggested_nickname); $test_user = User::getKV('nickname', $suggested_nickname);
if($test_user) { if ($test_user) {
//someone already exists with the suggested nickname //someone already exists with the suggested nickname
//not much else we can do //not much else we can do
}else{ } else {
$user = $this->autoRegister($nickname, $suggested_nickname); $user = $this->autoRegister($nickname, $suggested_nickname);
if ($user instanceof User) { if ($user instanceof User) {
User_username::register($user,$nickname,$this->provider_name); User_username::register($user, $nickname, $this->provider_name);
return false; return false;
} }
} }
} }
} }
function onStartCheckPassword($nickname, $password, &$authenticatedUser){ public function onStartCheckPassword($nickname, $password, &$authenticatedUser)
{
//map the nickname to a username //map the nickname to a username
$user_username = new User_username(); $user_username = new User_username();
$user_username->username=$nickname; $user_username->username = $nickname;
$user_username->provider_name=$this->provider_name; $user_username->provider_name = $this->provider_name;
if($user_username->find() && $user_username->fetch()){ if ($user_username->find() && $user_username->fetch()) {
$authenticated = $this->checkPassword($user_username->username, $password); $authenticated = $this->checkPassword($user_username->username, $password);
if($authenticated){ if ($authenticated) {
$authenticatedUser = User::getKV('id', $user_username->user_id); $authenticatedUser = User::getKV('id', $user_username->user_id);
return false; return false;
} }
}else{ } else {
//$nickname is the username used to login //$nickname is the username used to login
//$suggested_nickname is the nickname the auth provider suggests for that username //$suggested_nickname is the nickname the auth provider suggests for that username
$suggested_nickname = $this->suggestNicknameForUsername($nickname); $suggested_nickname = $this->suggestNicknameForUsername($nickname);
$user = User::getKV('nickname', $suggested_nickname); $user = User::getKV('nickname', $suggested_nickname);
if($user){ if ($user) {
//make sure this user isn't claimed //make sure this user isn't claimed
$user_username = new User_username(); $user_username = new User_username();
$user_username->user_id=$user->id; $user_username->user_id = $user->id;
$we_can_handle = false; $we_can_handle = false;
if($user_username->find()){ if ($user_username->find()) {
//either this provider, or another one, has already claimed this user //either this provider, or another one, has already claimed this user
//so we cannot. Let another plugin try. //so we cannot. Let another plugin try.
return; return;
}else{ } else {
//no other provider claims this user, so it's safe for us to handle it //no other provider claims this user, so it's safe for us to handle it
$authenticated = $this->checkPassword($nickname, $password); $authenticated = $this->checkPassword($nickname, $password);
if($authenticated){ if ($authenticated) {
$authenticatedUser = $user; $authenticatedUser = $user;
User_username::register($authenticatedUser,$nickname,$this->provider_name); User_username::register($authenticatedUser, $nickname, $this->provider_name);
return false; return false;
} }
} }
}else{ } else {
$authenticated = $this->checkPassword($nickname, $password); $authenticated = $this->checkPassword($nickname, $password);
if($authenticated){ if ($authenticated) {
if(! Event::handle('AutoRegister', array($nickname, $this->provider_name, &$authenticatedUser))){ if (!Event::handle('AutoRegister', [$nickname, $this->provider_name, &$authenticatedUser])) {
//unlike most Event::handle lines of code, this one has a ! (not) //unlike most Event::handle lines of code, this one has a ! (not)
//we want to do this if the event *was* handled - this isn't a "default" implementation //we want to do this if the event *was* handled - this isn't a "default" implementation
//like most code of this form. //like most code of this form.
if($authenticatedUser){ if ($authenticatedUser) {
return false; return false;
} }
} }
} }
} }
} }
if($this->authoritative){ if ($this->authoritative) {
return false; return false;
}else{ } else {
//we're not authoritative, so let other handlers try //we're not authoritative, so let other handlers try
return; return;
} }
} }
function onStartChangePassword(Profile $target ,$oldpassword, $newpassword) public function onStartChangePassword(Profile $target, $oldpassword, $newpassword)
{ {
if($this->password_changeable){ if ($this->password_changeable) {
$user_username = new User_username(); $user_username = new User_username();
$user_username->user_id = $target->getID(); $user_username->user_id = $target->getID();
$user_username->provider_name=$this->provider_name; $user_username->provider_name = $this->provider_name;
if ($user_username->find(true)) { if ($user_username->find(true)) {
$authenticated = $this->checkPassword($user_username->username, $oldpassword); $authenticated = $this->checkPassword($user_username->username, $oldpassword);
if($authenticated){ if ($authenticated) {
$result = $this->changePassword($user_username->username,$oldpassword,$newpassword); $result = $this->changePassword($user_username->username, $oldpassword, $newpassword);
if($result){ if ($result) {
//stop handling of other handlers, because what was requested was done //stop handling of other handlers, because what was requested was done
return false; return false;
}else{ } else {
// TRANS: Exception thrown when a password change fails. // TRANS: Exception thrown when a password change fails.
throw new Exception(_('Password changing failed.')); throw new Exception(_('Password changing failed.'));
} }
}else{ } else {
if($this->authoritative){ if ($this->authoritative) {
//since we're authoritative, no other plugin could do this //since we're authoritative, no other plugin could do this
// TRANS: Exception thrown when a password change fails. // TRANS: Exception thrown when a password change fails.
throw new Exception(_('Password changing failed.')); throw new Exception(_('Password changing failed.'));
}else{ } else {
//let another handler try //let another handler try
return null; return null;
} }
} }
} }
}else{ } else {
if($this->authoritative){ if ($this->authoritative) {
//since we're authoritative, no other plugin could do this //since we're authoritative, no other plugin could do this
// TRANS: Exception thrown when a password change attempt fails because it is not allowed. // TRANS: Exception thrown when a password change attempt fails because it is not allowed.
throw new Exception(_('Password changing is not allowed.')); throw new Exception(_('Password changing is not allowed.'));
@ -238,21 +243,22 @@ abstract class AuthenticationModule extends Module
} }
} }
function onStartAccountSettingsPasswordMenuItem($widget) public function onStartAccountSettingsPasswordMenuItem($widget)
{ {
if($this->authoritative && !$this->password_changeable){ if ($this->authoritative && !$this->password_changeable) {
//since we're authoritative, no other plugin could change passwords, so do not render the menu item //since we're authoritative, no other plugin could change passwords, so do not render the menu item
return false; return false;
} }
} }
function onCheckSchema() { public function onCheckSchema()
{
$schema = Schema::get(); $schema = Schema::get();
$schema->ensureTable('user_username', User_username::schemaDef()); $schema->ensureTable('user_username', User_username::schemaDef());
return true; return true;
} }
function onUserDeleteRelated($user, &$tables) public function onUserDeleteRelated($user, &$tables)
{ {
$tables[] = 'User_username'; $tables[] = 'User_username';
return true; return true;

91
modules/AuthCrypt/AuthCryptModule.php
View File

@ -1,50 +1,44 @@
<?php <?php
// This file is part of GNU social - https://www.gnu.org/software/social
//
// GNU social is free software: you can redistribute it and/or modify
// it under the terms of the GNU Affero General Public License as published by
// the Free Software Foundation, either version 3 of the License, or
// (at your option) any later version.
//
// GNU social is distributed in the hope that it will be useful,
// but WITHOUT ANY WARRANTY; without even the implied warranty of
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
// GNU Affero General Public License for more details.
//
// You should have received a copy of the GNU Affero General Public License
// along with GNU social. If not, see <http://www.gnu.org/licenses/>.
/** /**
* StatusNet, the distributed open-source microblogging tool
*
* Module to use crypt() for user password hashes * Module to use crypt() for user password hashes
* *
* PHP version 5
*
* LICENCE: This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU Affero General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU Affero General Public License for more details.
*
* You should have received a copy of the GNU Affero General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*
* @category Module * @category Module
* @package GNUsocial * @package GNUsocial
* @author Mikael Nordfeldth <mmn@hethane.se> * @author Mikael Nordfeldth <mmn@hethane.se>
* @copyright 2012 StatusNet, Inc. * @copyright 2012 StatusNet, Inc.
* @copyright 2013 Free Software Foundation, Inc http://www.fsf.org * @copyright 2013 Free Software Foundation, Inc http://www.fsf.org
* @license http://www.fsf.org/licensing/licenses/agpl-3.0.html GNU Affero General Public License version 3.0 * @license https://www.gnu.org/licenses/agpl.html GNU AGPL v3 or later
* @link http://www.gnu.org/software/social/
*/ */
if (!defined('GNUSOCIAL')) { exit(1); } defined('GNUSOCIAL') || die;
class AuthCryptModule extends AuthenticationModule class AuthCryptModule extends AuthenticationModule
{ {
const MODULE_VERSION = '2.0.0'; const MODULE_VERSION = '2.0.0';
protected $hash = '$6$'; // defaults to SHA512, i.e. '$6$', in onInitializeModule()
protected $statusnet = true; // if true, also check StatusNet style password hash protected $statusnet = true; // if true, also check StatusNet style password hash
protected $overwrite = true; // if true, password change means overwrite with crypt() protected $overwrite = true; // if true, password change means overwrite with crypt()
protected $argon = false; // Use Argon if supported. protected $argon = false; // Use Argon if supported.
public $provider_name = 'password_hash'; // not actually used public $provider_name = 'crypt'; // not actually used
/* // FUNCTIONALITY
* FUNCTIONALITY
*/
function checkPassword($username, $password) public function checkPassword($username, $password)
{ {
$username = Nickname::normalize($username); $username = Nickname::normalize($username);
@ -79,24 +73,12 @@ class AuthCryptModule extends AuthenticationModule
return false; return false;
} }
protected function cryptSalt($len=CRYPT_SALT_LENGTH)
{
$chars = "./0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
$salt = '';
for ($i=0; $i<$len; $i++) {
$salt .= $chars[mt_rand(0, strlen($chars)-1)];
}
return $salt;
}
// $oldpassword is already verified when calling this function... shouldn't this be private?! // $oldpassword is already verified when calling this function... shouldn't this be private?!
function changePassword($username, $oldpassword, $newpassword) public function changePassword($username, $oldpassword, $newpassword)
{ {
$username = Nickname::normalize($username); $username = Nickname::normalize($username);
if($this->overwrite == false) { if (!$this->overwrite) {
return false; return false;
} }
@ -104,24 +86,24 @@ class AuthCryptModule extends AuthenticationModule
if (empty($user)) { if (empty($user)) {
return false; return false;
} }
$original = clone($user); $original = clone $user;
$user->password = $this->hashPassword($newpassword, $user->getProfile()); $user->password = $this->hashPassword($newpassword, $user->getProfile());
return (true === $user->validate() && $user->update($original)); return $user->validate() === true && $user->update($original);
} }
public function hashPassword($password, Profile $profile=null) public function hashPassword($password, ?Profile $profile = null)
{ {
$algorithm = PASSWORD_DEFAULT; $algorithm = PASSWORD_DEFAULT;
$options = ['cost' => 12]; $options = ['cost' => 12];
if($this->argon == true && version_compare(PHP_VERSION, '7.2.0') == 1) { if ($this->argon) {
$algorithm = PASSWORD_ARGON2I; $algorithm = PASSWORD_ARGON2I;
$options = [ $options = [
'memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST, 'memory_cost' => PASSWORD_ARGON2_DEFAULT_MEMORY_COST,
'time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST, 'time_cost' => PASSWORD_ARGON2_DEFAULT_TIME_COST,
'threads' => PASSWORD_ARGON2_DEFAULT_THREADS 'threads' => PASSWORD_ARGON2_DEFAULT_THREADS,
]; ];
} }
// Use the modern password hashing algorithm // Use the modern password hashing algorithm
@ -130,9 +112,7 @@ class AuthCryptModule extends AuthenticationModule
return password_hash($password, $algorithm, $options); return password_hash($password, $algorithm, $options);
} }
/* // EVENTS
* EVENTS
*/
public function onStartChangePassword(Profile $target, $oldpassword, $newpassword) public function onStartChangePassword(Profile $target, $oldpassword, $newpassword)
{ {
@ -146,17 +126,17 @@ class AuthCryptModule extends AuthenticationModule
} }
$changed = $this->changePassword($target->getNickname(), $oldpassword, $newpassword); $changed = $this->changePassword($target->getNickname(), $oldpassword, $newpassword);
return (!$changed && empty($this->authoritative)); return !$changed && empty($this->authoritative);
} }
public function onStartCheckPassword($nickname, $password, &$authenticatedUser) public function onStartCheckPassword($nickname, $password, &$authenticatedUser)
{ {
$authenticatedUser = $this->checkPassword($nickname, $password); $authenticatedUser = $this->checkPassword($nickname, $password);
// if we failed, only return false to stop plugin execution if we're authoritative // if we failed, only return false to stop plugin execution if we're authoritative
return (!($authenticatedUser instanceof User) && empty($this->authoritative)); return !($authenticatedUser instanceof User) && empty($this->authoritative);
} }
public function onStartHashPassword(&$hashed, $password, Profile $profile=null) public function onStartHashPassword(&$hashed, $password, ?Profile $profile = null)
{ {
$hashed = $this->hashPassword($password, $profile); $hashed = $this->hashPassword($password, $profile);
return false; return false;
@ -176,13 +156,14 @@ class AuthCryptModule extends AuthenticationModule
public function onModuleVersion(array &$versions): bool public function onModuleVersion(array &$versions): bool
{ {
$versions[] = array('name' => 'AuthCrypt', $versions[] = [
'name' => 'AuthCrypt',
'version' => self::MODULE_VERSION, 'version' => self::MODULE_VERSION,
'author' => 'Mikael Nordfeldth', 'author' => 'Mikael Nordfeldth',
'homepage' => GNUSOCIAL_ENGINE_REPO_URL . 'tree/master/plugins/AuthCrypt', 'homepage' => GNUSOCIAL_ENGINE_REPO_URL . 'tree/master/plugins/AuthCrypt',
'rawdescription' => 'rawdescription' => // TRANS: Module description.
// TRANS: Module description. _m('Authentication and password hashing with crypt()')
_m('Authentication and password hashing with crypt()')); ];
return true; return true;
} }
} }

36
modules/AuthCrypt/README
View File

@ -1,36 +0,0 @@
AuthCrypt allows for StatusNet and GNU social to use crypt() hashing to store password credentials.
Requirements
============
Nothing out of the ordinary (SHA512 is supported natively since PHP 5.3.2)
Installation
============
Add either of the following configurations to your config.php (see Example below for more options):
The recommended use is to overwrite old hash values when logging in (statusnet + overwrite modes) and be the authority on password checks when logging in. If you only wish to update entries on password change the default values are enough. 'statusnet' and 'overwrite' are true by default. 'authoritative' is only necessary if we want to exclude other plugins from verifying the password.
addModule('AuthCrypt');
To disable updating to crypt() on password change (and login with the 'statusnet' compatibility mode), simply set the 'overwrite' setting to false:
addModule('AuthCrypt', array(
'overwrite'=>false,
));
Settings
========
Default values in parenthesis. Many settings are inherited from the AuthenticationModule class.
authoritative (false): Set this to true when _all_ passwords are hashed with crypt()
(warning: this may disable all other password verification, also when changing passwords!)
hash ('$6$'): Hash signature to use, defaults to SHA512. See all supported strings at http://php.net/crypt
(warning: set this to something crypt() understands, or you will default to the very weak 2-char DES scheme)
statusnet (true): Do we check the password against legacy StatusNet md5 hash?
(notice: will check password login against old-style hash and if 'overwrite' is enabled update using crypt())
overwrite (true): Do we overwrite old style password hashes with crypt() hashes on password change?
(notice: to make use of stronger security or migrate to crypt() hashes, this must be true)
password_changeable (true): Enables or disables password changing.
(notice: if combined with authoritative, it disables changing passwords and removes option from menu.)
autoregistration: This setting is ignored. Password can never be valid without existing User.
provider_name: This setting defaults to 'crypt' but is never stored anywhere.

20
modules/AuthCrypt/README.md Normal file
View File

@ -0,0 +1,20 @@
AuthCrypt allows for GNU social to use password_hash() hashing to store password credentials.
Settings
========
You can change these settings in `config.php` with `$config['AuthCryptModule'][{setting name}] = {new setting value};`.
Default values in parenthesis.
authoritative (false): Set this to true when _all_ passwords are hashed with crypt()
(warning: this may disable all other password verification, also when changing passwords!)
statusnet (true): Do we check the password against legacy StatusNet md5 hash?
(notice: will check password login against old-style hash and if 'overwrite' is enabled update using crypt())
overwrite (true): Do we overwrite old style password hashes with crypt() hashes on password change?
(notice: to make use of stronger security or migrate to crypt() hashes, this must be true)
password_changeable (true): Enables or disables password changing.
(notice: if combined with authoritative, it disables changing passwords and removes option from menu.)
autoregistration: This setting is ignored. Password can never be valid without existing User.
provider_name: This setting defaults to 'crypt' but is never stored anywhere.
Technical note: Many settings are inherited from the AuthenticationModule class.