I think you are aware of possible solutions But let me clarify it:
Solution 1: Easy Quick Solution
what alan Storm Suggested:-
- Ask your customer to change password by sending them reset password link.
- Reset all Password Manually or by script & send them.
How you can do that: (put in root folder & run
script for send password reset link to all customers)
include('app/bootstrap.php'); // add bootstrap file
use Magento\Framework\App\Bootstrap;
use Magento\Customer\Api\AccountManagementInterface;
use Magento\Customer\Model\AccountManagement;
$bootstrap = Bootstrap::create(BP, $_SERVER);
$objectManager = $bootstrap->getObjectManager();
$state = $objectManager->get('Magento\Framework\App\State');
$state->setAreaCode('frontend');
$_customers = $objectManager->create('Magento\Customer\Api\AccountManagementInterface');
$customerCollection = $objectManager->create('Magento\Customer\Model\ResourceModel\Customer\Collection');
$customerCollection->load(); // get customers
$i = 0;
foreach ($customerCollection as $customers) {
$email = $customers->getData('email');
try {
$_customers->initiatePasswordReset($email, AccountManagement::EMAIL_RESET);
} catch (NoSuchEntityException $e) {
// Do nothing, we don't want anyone to use this action to determine which email accounts are registered.
} catch (\Exception $exception) {
echo __('We\'re unable to send the password reset email.');
}
echo "<pre>";
echo $i . " Email :-" . $email . " Mail Sent";
$i++;
}
Solution 2. ( Not Recommended but also work)
Hash algorithm can not change from one to another (md5 to sh1/sh2). Magento2 doesn't support SHA1 (deprecated
)
Hashing algorithms are one-way i.e. They cannot be reversed unlike Encryption-Decryption algorithms.
you can't get back string(password) But you can check same hash value by brute force
.
Magento 1.x has stored password similar to
password =
353dc2ba6108461cf3468184bdd0e174:LM
=> md5($password.$salt):salt.
Pseudo code
if( md(5) [password [1].userenteredpasswd])==password [0])
{
# User Authenticated
}
in your case
6de015050ee16e5451019072f77f2bf50c3c02bc:VLAyPWtkZsHa00UMCWrFNtJ1ARoBp4Wc
sh1(md5($password.$salt)):sha1(salt)
As Magento2 store in this way
5ca6a208eba1be74251419d22399925c01fbe36f72c5b472d110c40c119b8709:QTwASvDZV6kKPNCl8eHZGZfF1U8NaoRB:1
hash('SHA-256', $salt . $password):$salt:1
Hash Value:(random 32 bit character):(Hashing algorithm version default:1)
- MD5 produces 128 bit(16 byte) hash value(supported by magento 1.x , 2.x).
- SHA-1 produces 160 bit hash value.
- SHA-2(SHA-256) produces 256 bit hash value(supported by magento 2.x).
What you have to do now:
authenticate users by extra step and also save in similar manner.
Pseudo code
if( sh2(sh1(md(5) [password [1].userenteredpasswd])))==password [0])
{
# User Authenticated
}
Want to change in core files to support SHA1
?
it's hashing password and encrypt/decrypt library using cryptographic algorithms.
https://github.com/magento/magento2/blob/2.2-develop/lib/internal/Magento/Framework/Encryption/Encryptor.php
or
write a plugin for extra authenticate step
for \Magento\Customer\Api\AccountManagementInterface::authenticate()
.
check this
https://github.com/magento/magento2/blob/2.2-develop/app/code/Magento/Customer/Api/AccountManagementInterface.php