FOSUserBundle - how is password salt applied?

Question

For reasons I can't explain (NDA... and yeah, I know that sounds sketchy), I need to be able to log users into my system outside of the normal Symfony/FOSUserBundle login flow. In order to do this, I need to know how FOSUserBundle applies its salt to the plain password, and I haven't found it yet. So, a nudge in the right direction would be greatly appreciated.

My encoder is currently set as:

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: sha512

Answer 1

You may be looking for this:

http://symfony.com/doc/current/book/security.html#determining-the-hashed-password

$factory = $this->get('security.encoder_factory');
$user = new Acme\UserBundle\Entity\User();   

$encoder = $factory->getEncoder($user);
$password = $encoder->encodePassword('plainpassword', $user->getSalt());
$user->setPassword($password);

Answer 2

Your question can not get a precise answer because there is not only one encoder for passwords in Symfony. It mainly depends on the configuration you use but to give you the direct direction, you should take a look to the encoders located under the Symfony\Component\Security\Core\Encoder namespace and read the code. Then, you should understand how salt and password are combined together.