Migrate user password hash

Question

We are migrating our old site from plain PHP to Drupal 8. Passwords are hashed with MD5 in the old site; I need to migrate them in Drupal.

I tried the following code, but it takes the password as plain text and calculates its SHA hash.

public function prepareRow(Row $row) {
    $password = $row->getSourceProperty('user_password');
    $hash = \Drupal::service('password')->hash($password);
    $row->setSourceProperty('user_password', $hash);
  }

This is the configuration file.

id: users
label: User migration
migration_group: mymodule_general_migration_groups
source:
  plugin: mymodule_migration_users
process:
  pass: user_password
  mail: user_email
  init: user_email
  status:
    plugin: default_value
    default_value: 1
  name:
    plugin: dedupe_entity
    source: username
    entity_type: user
    field: name
    postfix: _
  created:
    plugin: callback
    source: created
    callable: strtotime
  changed: user_regdate
  access: user_regdate
  login: user_lastvisit
destination:
  plugin: entity:user
  md5_password: true
migration_dependencies: {}
dependencies:
  enforced:
    module:
      - mymodule_migration

Answer 1

Since you don't know the password, only the hash, you can't migrate it directly. (MD5 is weak, but not that weak.) The whole purpose of hashing is that the password should be unknown to anyone except the user. There are 2 solutions to this.

• Reset all your users password and send a one-time-login password to them once they are migrated - as already suggested in the comments above.
• Write custom code that rehashes the password at login: "If the password is hashed with MD5, rehash it and store the hash when the user (successfully) logs in." This works because at login you have the user's password because they just entered it. And you know which hashing algorithm is used from the stored hash.Initially, you migrate the users with the MD5 password hash.

It turns out that Drupal does rehashing automatically (see UserAuth::authenticate()), but not for MD5 unless you modify the existing hash slightly by prefixing it with an "U". (Thanks, d70rr3s and Souvik Das.) See also user_update_7000.

Answer 2

This simple code is working properly while migrating md5 password to drupal 8

$password_service = \Drupal::service('password');

  $password = $row->getSourceProperty('user_password'); // 'user_password' is the old db column which is in md5 format

  $hashed_password = 'U' . $password_service->hash($password); // U will indicate that the password needs rehashing.
  $row->setSourceProperty('hash_password', $hashed_password);