What is the cleanest way to add code to contrib.auth

Question

I've migrated an old joomla installation over to django. The password hashes is an issue though. I had to modify the get_hexdigest in contrib.auth.models to have an extra if statement to reverse the way the hash is generated.

# Custom for Joomla
if algorithm == 'joomla':
    return md5_constructor(raw_password + salt).hexdigest()
# Djangos original md5
if algorithm == 'md5':
    return md5_constructor(salt + raw_password).hexdigest()

I also added the following to the User model to update the passwords after login if they have the old joomla style:

# Joomla Backwards compat
algo, salt, hsh = self.password.split('$')
if algo == 'joomla':
    is_correct = (hsh == get_hexdigest(algo, salt, raw_password))
    if is_correct:
        # Convert the password to the new more secure format.
        self.set_password(raw_password)
        self.save()
    return is_correct

Everything is working perfectly but I'd rather not edit this code directly in the django tree. Is there a cleaner way to do this in my own project?

Thanks

Answer 1

Your best bet would be to roll a custom auth backend and rewrite get_hexdigest in there. Never done it myself, but documentation on how to do so is available at http://docs.djangoproject.com/en/dev/topics/auth/#authentication-backends.