Change drupal 7 way of hashing password?

Question

Hi I am trying to migrate users from a legacy custom CMS site that used "sha256" technique to hash passwords to drupal 7 platform.

Upon further reading I came to know that drupal 7 stores passwords as salted and sha512 hash.

How can I change drupal 7 way of storing password hashes/ authentication of users to sha256 technique? Any direction would be helpful.

Answer 1

This is entirely possible but requires custom code for your alternative solution. For an example see: https://www.drupal.org/node/1109374#comment-4711644

From the linked thread you may simply:

(1) Create a new module, I called mine projectname_legacy_auth

/**
 * supply alternate authentication schemes
 */
variable_set('password_inc', drupal_get_path('module', 'projectname_legacy_auth') . '/projectname_legacy_auth_password.inc');

function projectname_legacy_auth_uninstall() {
  // put it back the way it was...
  variable_set('password_inc', 'includes/password.inc');
}

function projectname_legacy_auth_disable() {
  // put it back the way it was...
  variable_set('password_inc', 'includes/password.inc');
}            

(2) add the authentication mechanisms you need to projectname_legacy_auth_password.inc'. In this case, it's md5().

/**
 * simplified example for md5, no salting
 */
function user_check_password($password, $account) {
  if ($account->pass == md5($password)) {
    return TRUE;
  }
  return FALSE;
}

/**
 * Simplified example for md5 hashes, no salting
 */
function user_hash_password($password, $count_log2 = 0) {
  return md5($password);
}

/**
 * this is probably a bad idea :-)
 */
function user_needs_new_hash($account) {
  return FALSE;
}

Answer 2

This isn't possible, and it really shouldn't be. Your best bet is to reset all passwords and require that users change them when they want to access the new site. It's a pain in the butt, but it's the "right" way to do it.

I was wrong! See @tenken's comment below...