Se need to import a large user table to a Craft installation. Unfortunately, the passwords in the imported data are SHA1 encrypted (and salted).

What is the best way to enable the login of the users?

We thought that we add an extra column to the table which defined if the hash is standard or SHA1.

If a user logs in where the password is SHA1, then we check if it's the correct password and change it to the standard hash.

This would be the most comfortable way for the existing users.

Question: Is this a possible solution, especially is it possible to hook up into the login process to create the logic for the check.

Or would you recommend other solutions?


Short answer, it can't be done. Possibly with some extensive hacking, but I would highly caution against that.

  • Directly importing passwords isn't really possible, since the original passwords are unknown.
  • Adding a custom password column to the database is a bad idea, since Craft user/password management is pretty deeply embedded within the system.

Here's what I would recommend instead... Prompt your users to reset their passwords.

I know this idea doesn't seem ideal initially, but it is not unprecedented. People are used to changing their passwords occasionally, and will generally be very understanding about it. Many folks have dealt with systems that force them to change their password every 3 months, and everyone has forgotten a password at one time or another.

I recently had to do this for a website with several hundred users. We ported from EE to Craft, leaving the front-end visually identical. Here's the message we showed to users after the switch:

Our login system has recently changed. Please note:

If you haven't logged in since January 10th, you will be required to reset your password.

  • Maintaining a system with a custom password field sounds like a nightmare (for you). Forcing your users to change their password (once) is a minor hurdle that they can easily clear.
    – Lindsey D
    Jun 29 '15 at 16:55
  • OK but how do you do that when you import 4000 new users??
    – migswd
    Sep 17 '15 at 14:47
  • The exact same way. My use case involved only a few hundred users... I'd imagine you may end up dealing with more customer support if you've got thousands. But otherwise, I'd do it the exact same way.
    – Lindsey D
    Sep 17 '15 at 16:37
  • OK but what is the process exactly ? They arrive on the website, want to login and see your message, click on the reset pwd link. Then in the reset form you need to ask for the email address first no? Then they click the button reset and receive an email with the reset password link. Correct ?
    – migswd
    Sep 17 '15 at 17:20
  • Yup, exactly. :)
    – Lindsey D
    Sep 17 '15 at 18:22

The Legacy Login plugin handles authentication from legacy systems such as ExpressionEngine and BigCommerce. It works by intercepting the login, and if the given credentials fail to authenticate with a native user, it tries authenticating a legacy user using the legacy system's particular hashing method.

You could add another driver by copying the existing ones and tweaking the methods based on the setup of your particular system.


Your way sounds possible.

You'd need to write a Craft plugin that listened for the onBeforeLogin event. Only the username is passed in as a parameter, but you can grab the submitted password though POST with craft()->request->getPost('password').

Your plugin would have a record that has two columns. One is the SHA1 hash from the old system and the other is a userId column with a foreign key constraint to Craft's craft_users table on the id column.

It would them take the submitted password and verify the SHA1 hash matches. If so, take the same submitted password, run it through craft()->security->hashPassword() and updated the appropriate password column in the craft_users table for the user.

Alternatively, you can have them reset their password as Lindsey points out.

  • My Legacy Login plugin works very similarly to this. I use a completely separate action instead of hooking onto onBeforeLogin... I should probably change that, as using the Event seems like a more elegant solution overall. Apr 5 '16 at 15:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.