<p>The <a href="https://github.com/TopShelfCraft/Legacy-Login" rel="nofollow">Legacy Login</a> plugin handles authentication from legacy systems such as ExpressionEngine and BigCommerce. It works by intercepting the login, and if the given credentials fail to authenticate with a native user, it tries authenticating a legacy user using the legacy system's particular hashing method.</p>

<p>You could add another driver by copying the existing ones and tweaking the methods based on the setup of your particular system.</p>

CC BY-SA 3.0
2016-04-05T15:33:56.083Z
2016-04-05T15:33:56.083Z
Michael Rog
<p>Your way sounds possible.</p>

<p>You'd need to write a Craft plugin that listened for the <a href="http://buildwithcraft.com/docs/plugins/events-reference#userSession-onBeforeLogin" rel="nofollow noreferrer">onBeforeLogin</a> event.  Only the <code>username</code> is passed in as a parameter, but you can grab the submitted password though POST with <code>craft()-&gt;request-&gt;getPost('password')</code>.</p>

<p>Your plugin would have a <a href="http://buildwithcraft.com/docs/plugins/records" rel="nofollow noreferrer">record</a> that has two columns.  One is the SHA1 hash from the old system and the other is a <code>userId</code> column with a foreign key constraint to Craft's <code>craft_users</code> table on the <code>id</code> column.</p>

<p>It would them take the submitted password and verify the SHA1 hash matches.  If so, take the same submitted password, run it through <a href="http://buildwithcraft.com/classreference/services/SecurityService#hashPassword-detail" rel="nofollow noreferrer">craft()->security->hashPassword()</a> and updated the appropriate <code>password</code> column in the <code>craft_users</code> table for the user.</p>

<p>Alternatively, you can have them reset their password as <a href="https://craftcms.stackexchange.com/a/10395/57">Lindsey points out</a>.</p>

CC BY-SA 3.0
2016-04-05T15:35:35.170Z
My [Legacy Login](https://github.com/TopShelfCraft/Legacy-Login) plugin works very similarly to this. I use a completely separate action instead of hooking onto `onBeforeLogin`... I should probably change that, as using the Event seems like a more elegant solution overall.
Michael Rog
CC BY-SA 3.0
2015-06-29T17:13:17.580Z
2015-06-29T17:13:17.580Z
2017-04-13T12:51:00.253Z
Brad Bell
<p>Short answer, it can't be done. Possibly with some extensive hacking, but I would <em>highly</em> caution against that.</p>

<ul>
<li>Directly importing passwords isn't really possible, since the original passwords are unknown.</li>
<li>Adding a custom password column to the database is a bad idea, since Craft user/password management is pretty deeply embedded within the system.</li>
</ul>

<p>Here's what I would recommend instead... <strong>Prompt your users to reset their passwords.</strong></p>

<p>I know this idea doesn't seem ideal initially, but it is not unprecedented. People are used to changing their passwords occasionally, and will generally be very understanding about it. Many folks have dealt with systems that force them to change their password every 3 months, and <em>everyone</em> has forgotten a password at one time or another.</p>

<p>I recently had to do this for a website with several hundred users. We ported from EE to Craft, leaving the front-end visually identical. Here's the message we showed to users after the switch:</p>

<blockquote>
  <p><strong>Our login system has recently changed.</strong> Please note:</p>
  
  <p>If you haven't logged in since January 10th, <strong>you will be required to <a href="http://example.com/reset-password" rel="nofollow">reset your password</a>.</strong></p>
</blockquote>

CC BY-SA 3.0
2015-06-29T16:55:27.010Z
Maintaining a system with a custom password field sounds like a nightmare (for you). Forcing your users to change their password (once) is a minor hurdle that they can easily clear.
Lindsey D
CC BY-SA 3.0
2015-09-17T14:47:57.900Z
OK but how do you do that when you import 4000 new users??
migmaker
CC BY-SA 3.0
2015-09-17T16:37:23.510Z
The exact same way. My use case involved only a few hundred users... I'd imagine you may end up dealing with more customer support if you've got thousands. But otherwise, I'd do it the exact same way.
Lindsey D
CC BY-SA 3.0
2015-09-17T17:20:11.657Z
OK but what is the process exactly ? They arrive on the website, want to login and see your message, click on the reset pwd link. Then in the reset form you need to ask for the email address first no? Then they click the button reset and receive an email with the reset password link. Correct ?
migmaker
CC BY-SA 3.0
2015-09-17T18:22:47.890Z
Yup, exactly. :)
Lindsey D
CC BY-SA 3.0
2015-09-17T22:39:21.283Z
Alright I do that. Thx.
migmaker
CC BY-SA 3.0
2015-06-29T16:51:13.810Z
2015-06-29T16:51:13.810Z
Lindsey D
<p>Se need to import a large user table to a Craft installation. Unfortunately, the passwords in the imported data are SHA1 encrypted (and salted).</p>

<p>What is the best way to enable the login of the users?</p>

<p>We thought that we add an extra column to the table which defined if the hash is standard or SHA1.</p>

<p>If a user logs in where the password is SHA1, then we check if it's the correct password and change it to the standard hash.</p>

<p>This would be the most comfortable way for the existing users.</p>

<p>Question: Is this a possible solution, especially is it possible to hook up into the login process to create the logic for the check.</p>

<p>Or would you recommend other solutions?</p>

<users><password><import><hash>
How can I import existing users with passwords stored in a different format than Craft's hash format?
# How can I import existing users with passwords stored in a different format than Craft's hash format?

(Asked by: username_0 on 2015-06-29)

Se need to import a large user table to a Craft installation. Unfortunately, the passwords in the imported data are SHA1 encrypted (and salted).

What is the best way to enable the login of the users?

We thought that we add an extra column to the table which defined if the hash is standard or SHA1.

If a user logs in where the password is SHA1, then we check if it's the correct password and change it to the standard hash.

This would be the most comfortable way for the existing users.

Question: Is this a possible solution, especially is it possible to hook up into the login process to create the logic for the check.

Or would you recommend other solutions?

**Tags:** users, password, import, hash

---

## 3 answers

### Answer by username_3 on 2015-06-29. Score: 4 | Accepted answer

Short answer, it can't be done. Possibly with some extensive hacking, but I would *highly* caution against that.

* Directly importing passwords isn't really possible, since the original passwords are unknown.
* Adding a custom password column to the database is a bad idea, since Craft user/password management is pretty deeply embedded within the system.

Here's what I would recommend instead... **Prompt your users to reset their passwords.**

I know this idea doesn't seem ideal initially, but it is not unprecedented. People are used to changing their passwords occasionally, and will generally be very understanding about it. Many folks have dealt with systems that force them to change their password every 3 months, and *everyone* has forgotten a password at one time or another.

I recently had to do this for a website with several hundred users. We ported from EE to Craft, leaving the front-end visually identical. Here's the message we showed to users after the switch:

> **Our login system has recently changed.** Please note:
>
> If you haven't logged in since January 10th, **you will be required to [reset your password](http://example.com/reset-password).**

> **Comments:**
> **username_3**: Maintaining a system with a custom password field sounds like a nightmare (for you). Forcing your users to change their password (once) is a minor hurdle that they can easily clear.  
> **username_4**: OK but how do you do that when you import 4000 new users??  
> **username_3**: The exact same way. My use case involved only a few hundred users... I'd imagine you may end up dealing with more customer support if you've got thousands. But otherwise, I'd do it the exact same way.  
> **username_4**: OK but what is the process exactly ? They arrive on the website, want to login and see your message, click on the reset pwd link. Then in the reset form you need to ask for the email address first no? Then they click the button reset and receive an email with the reset password link. Correct ?  
> **username_3**: Yup, exactly. :)  
> **username_4**: Alright I do that. Thx.  

---

### Answer by username_1 on 2016-04-05. Score: 3

The [Legacy Login](https://github.com/TopShelfCraft/Legacy-Login) plugin handles authentication from legacy systems such as ExpressionEngine and BigCommerce. It works by intercepting the login, and if the given credentials fail to authenticate with a native user, it tries authenticating a legacy user using the legacy system's particular hashing method.

You could add another driver by copying the existing ones and tweaking the methods based on the setup of your particular system.


---

### Answer by username_2 on 2015-06-29. Score: 2

Your way sounds possible.

You'd need to write a Craft plugin that listened for the [onBeforeLogin](http://buildwithcraft.com/docs/plugins/events-reference#userSession-onBeforeLogin) event. Only the `username` is passed in as a parameter, but you can grab the submitted password though POST with `craft()->request->getPost('password')`.

Your plugin would have a [record](http://buildwithcraft.com/docs/plugins/records) that has two columns. One is the SHA1 hash from the old system and the other is a `userId` column with a foreign key constraint to Craft's `craft_users` table on the `id` column.

It would them take the submitted password and verify the SHA1 hash matches. If so, take the same submitted password, run it through [craft()->security->hashPassword()](http://buildwithcraft.com/classreference/services/SecurityService#hashPassword-detail) and updated the appropriate `password` column in the `craft_users` table for the user.

Alternatively, you can have them reset their password as [Lindsey points out](https://craftcms.stackexchange.com/a/10395/57).

> **Comments:**
> **username_1**: My [Legacy Login](https://github.com/TopShelfCraft/Legacy-Login) plugin works very similarly to this. I use a completely separate action instead of hooking onto `onBeforeLogin`... I should probably change that, as using the Event seems like a more elegant solution overall.  

---

