Old Passwords

clarkwinkelmann

This extension allows your users to continue to login with their passwords from a previous platform that was using a different hashing algorithm than Flarum.

Installation

composer require migratetoflarum/old-passwords

Updating

composer update migratetoflarum/old-passwords
php flarum migrate
php flarum cache:clear

Documentation

This extension is meant to be used alongside a migration script. There are no settings accessible from the UI (you still need to keep the extension enabled for it to work !)

The migrations add a migratetoflarum_old_password column to your users table, which can contain old credentials hashed with different algorithms than bcrypt.

This column must contain a valid JSON-serialized object as described below or null to not provide an old password.

Once a user was correctly identified via an old password, the password is re-hashed with bcrypt, stored in Flarum password field and the migratetoflarum_old_password column is set to null.

If you somehow manage to have both a bcrypt-hashed password and migratetoflarum_old_password value in the database for a user, then the user will be able to login with either password. The password used will override the value of password and migratetoflarum_old_password will be set to null.

Compatible hashings

Check the README on GitHub for an up-to-date list of the options available https://github.com/migratetoflarum/old-passwords

A MigrateToFlarum extension

This is a free extension by MigrateToFlarum, an online forum migration tool (launching soon).
Follow us on Twitter for updates https://twitter.com/MigrateToFlarum

Need a custom Flarum extension ? Contact Clark Winkelmann !

Links

peppogiappe

clarkwinkelmann Hi Clark, in the table users i have to put old password inside the new field created by this extension? And in the field of 'password' what i have to put?

clarkwinkelmann

peppogiappe yes the old password goes in the new column as JSON according to the documentation found on the GitHub page. For the password column, you can put anything. If it's not a bcrypt hash it will never validate anyway. I recommend you simply store an empty string.

peppogiappe

clarkwinkelmann Thanks a lot, it's run perfectly!!

clarkwinkelmann

Existing version was still compatible with Flarum beta 14 because it doesn't contain any javascript.

Nonetheless released version 0.5.1 to take advantage of a new extender and to be visible on Extiverse again.

clarkwinkelmann

Release 0.5.2

Previous versions are already compatible with Flarum beta 15, this update just adds the category and links for the new Flarum admin panel.

clarkwinkelmann

Released version 0.6.0 with Flarum beta 16 compatibility.

Version 0.5.0 can also be installed on beta 16 due to Composer constraints and it might work, but will use deprecated Flarum features, so I recommend you make sure you're running 0.6.0 with Flarum beta 16.

clarkwinkelmann

Released version 1.0.0 with Flarum 1.0 compatibility.

From now on new hashers will be introduced in minor version rather than major versions.

Jackal

I’m reaching out because currently, my site uses SHA1 with a salt for password hashing, and I want to transition these passwords to Flarum while ensuring that existing users can still log in with their old credentials. I am willing to pay for assistance. If so, please let me know your availability and rate.

luceos

Jackal did you try whether this extension works? I think there's another that does something similar to this one, but testing them would be the first step I believe.

clarkwinkelmann

Jackal which software are you migrating from and do you already know how you are going to migrate the data to Flarum?

If you already have a script to migrate, then it's probably a matter of a few lines of code to insert the password in a format recognized by this extension.

Otherwise, you should first decide how you're going to migrate and if you contract someone to do it for you, they should be able to migrate the passwords without much trouble.

I'm available for any technical question regarding this extension, but don't have any availability for freelancing at the moment.

Jackal

I apologize for the misunderstanding. I have a limited understanding of computer languages, but I tried installing the extension using composer require maicol07/flarum-ext-sso. However, when I enabled it, there was no option for SHA-1—only SHA-256 and higher were available, so I'm assuming that's why it didn't work. My old PHP site required users to have a username, email, and password upon signup. Currently, I'm having members re-register on the forum if they want to use it, which might not be a bad idea.