Should I accept a crypted password with AuthLogic?

Question

Basically as the question asks.

The AuthLogic documentation for verify_password_method states:

The name of the method in your model used to verify the password. This should be an instance method. It should also be prepared to accept a raw password and a crytped password.

I'd like to support this, because it allows me to maintain our system's current masquerading behaviour without storing plain-text passwords like we have been in the past. However, it seems to me like allowing a simple string comparison to the crypted_password in the database is just as bad as storing the regular plain-text passwords.

Am I missing something here, or is there some other way to accept a crypted password in AuthLogic?

For reference, this is how I was going to write the valid_password? method:

def valid_password?(password, check_from_database = nil)
  if password == self.crypted_password
    true
  else
    super(password, check_from_database)
  end
end

Answer 1

Ok, turns out that there's a much easier way to do this (although it seems horribly undocumented, and didn't turn up with a Google search of how to achieve this).

Authlogic::Session::Base.new(@user, true)

That line allows session creation without checking credentials. Obviously you should be careful with this since it assumes that the user has already identified themselves correctly - for my usage, since there is a check to ensure the current user is the admin user, it's safe.