0

Hi I am trying to migrate users from a legacy custom CMS site that used "sha256" technique to hash passwords to drupal 7 platform.

Upon further reading I came to know that drupal 7 stores passwords as salted and sha512 hash.

How can I change drupal 7 way of storing password hashes/ authentication of users to sha256 technique? Any direction would be helpful.

4

This is entirely possible but requires custom code for your alternative solution. For an example see: https://www.drupal.org/node/1109374#comment-4711644

From the linked thread you may simply:

(1) Create a new module, I called mine projectname_legacy_auth

/**
 * supply alternate authentication schemes
 */
variable_set('password_inc', drupal_get_path('module', 'projectname_legacy_auth') . '/projectname_legacy_auth_password.inc');

function projectname_legacy_auth_uninstall() {
  // put it back the way it was...
  variable_set('password_inc', 'includes/password.inc');
}

function projectname_legacy_auth_disable() {
  // put it back the way it was...
  variable_set('password_inc', 'includes/password.inc');
}            

(2) add the authentication mechanisms you need to projectname_legacy_auth_password.inc'. In this case, it's md5().

/**
 * simplified example for md5, no salting
 */
function user_check_password($password, $account) {
  if ($account->pass == md5($password)) {
    return TRUE;
  }
  return FALSE;
}

/**
 * Simplified example for md5 hashes, no salting
 */
function user_hash_password($password, $count_log2 = 0) {
  return md5($password);
}

/**
 * this is probably a bad idea :-)
 */
function user_needs_new_hash($account) {
  return FALSE;
}
  • Why do you need to variable_set each and every time drupal bootstraps? Can't you just set it in $conf[... or even better on an module install hook? – cherouvim Sep 14 '17 at 7:52
0

This isn't possible, and it really shouldn't be. Your best bet is to reset all passwords and require that users change them when they want to access the new site. It's a pain in the butt, but it's the "right" way to do it.

I was wrong! See @tenken's comment below...

  • you can change the way drupal 7 stores passwords, and it's fully supported by Drupal because migrating Users and Systems such as his use-case can be problematic. See: drupal.org/node/1109374#comment-4711644 – tenken Oct 20 '15 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.