feat(auth): Implement remaining password hashing algorithms

.github/workflows/ci.yml

@@ -57,6 +57,14 @@ jobs:
       - name: Rust Cache
         uses: swatinem/rust-cache@98c8021b550208e191a6a3145459bfc9fb29c4c0 # v2.8.0
 
+      - name: Set up Python for cross-verification tests
+        uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
+        with:
+          python-version: '3.x'
+
+      - name: Install Python Keystone for cross-verification tests
+        run: pip install keystone
+
       - name: Run tests (unit)
         run: cargo nextest run
 

crates/config/src/identity.rs

@@ -68,6 +68,12 @@ pub enum PasswordHashingAlgo {
     /// Bcrypt.
     #[default]
     Bcrypt,
+    /// Bcrypt combined with SHA256.
+    BcryptSha256,
+    /// PBKDF2 with SHA512.
+    Pbkdf2Sha512,
+    /// Scrypt.
+    Scrypt,
     // #[cfg(test)]
     /// None. Should not be used outside of testing where expected value is
     /// necessary.

crates/core/Cargo.toml

@@ -46,13 +46,22 @@ tracing.workspace = true
 url = { workspace = true, features = ["serde"] }
 uuid = { workspace = true, features = ["v4"] }
 validator.workspace = true
+# pbkdf2 crate removed: PBKDF2-HMAC-SHA512 is implemented directly in
+# password_hashing.rs using the workspace hmac/sha2 to avoid a
+# digest v0.10 vs v0.11 version conflict (pbkdf2 v0.12 uses sha2 v0.10).
+scrypt = "0.11"
+subtle = "2.6.1"
 
 [dev-dependencies]
 config = { workspace = true }
 httpmock = { version = "0.8", features = ["http2"] }
 mockall.workspace = true
 openstack-keystone-core-types = { workspace = true, features = ["mock"] }
 rstest.workspace = true
+# `process` is test-only: the env-gated cross-verify tests shell out to
+# tools/cross_verify.py. Kept out of the main `tokio` dep to avoid pulling
+# process-spawning machinery into the production build.
+tokio = { workspace = true, features = ["process"] }
 tracing-test = { workspace = true, features = ["no-env-filter"] }
 url.workspace = true