10

I have migrated only customers from Magento 1.6.2.0 to Magento 2.2.3 and customers migrated successfully and listed properly in the admin section.

But when I try to login with the Magento 1 password I am not able to login.

So as I check in database the old passwords are stored differently than the Magento 2 passwords.

Here's a screenshot of the database table "customer_entity":

enter image description here

Basically I have found that when customer created from Magento 2 frontend there is a larger string after the first colon : and migrated passwords have only two character after the colon :.

4 Answers 4

5

"The data migration tool takes advantage of such backward compatibility in Magento to automatically migrate Customer password from Magento 1 to Magento 2. So your customers can use their md5() based password without the need to reset their passwords after migration. " Meaning they can log in with their md5 password ? I tried, to no avail.

15
  • Thanks, This command works for me php -f bin/magento customer:hash:upgrade Apr 25, 2018 at 10:17
  • I have done the above methods and that does not work for me. Any other suggestion? Iam using magento 2.2.4 and upgrade is from 1.9.2.4 Jun 27, 2018 at 4:20
  • @DivyaMuralidharan is there any error you get when you perform hash:upgrade command in SSH? Jun 27, 2018 at 4:59
  • @Jalpesh Yes. I got this error " [ReflectionException] Class Magento\Eav\Model\Attribute\Data\Datetime does not exist" Jun 27, 2018 at 5:46
  • @DivyaMuralidharan do you have any custom attribute in magento 1.9.2.4 which type is datetime?? Jun 27, 2018 at 6:44
3

After migrating database from magento1 to magento2, customer login problem occurs, to solve that problem just go to a file name encryptor.php in the vendor folder (Path is below) vendor\magento\framework\Encryption\Encryptor.php and change isValidHash() function like below.

        public function isValidHash($password, $hash)
       { 
          try { 

            $this->explodePasswordHash($hash);

           foreach ($this->getPasswordVersion() as $hashVersion) {

            if ($hashVersion == '0') {

                $recreated = current(explode(':', $hash));

            }else if ($hashVersion === self::HASH_VERSION_ARGON2ID13) {
                $recreated = $this->getArgonHash($password, $this->getPasswordSalt());
            } else {

                $recreated = $this->generateSimpleHash($this->getPasswordSalt() . $password, $hashVersion);
            }

            $hash = $this->getPasswordHash();
            error_log('password changing technique ======');
            error_log(print_r($recreated,true));
            error_log(print_r($hash,true));
        }
    } catch (\RuntimeException $exception) {
        //Hash is not a password hash.
        $recreated = $this->hash($password);
    }

    return Security::compareStrings(
        $recreated,
        $hash
    );
}

the above change wont cause any issue because once user login with above method, magento2 will change the password hash to its proper password format and you can see difference in customer_entity table in magento2 database.

6
  • Well, this works, but it's a very bad practice to edit files in /vendor folder
    – srokatonie
    Dec 19, 2019 at 13:59
  • 1
    Srokatonie I appreciate your comment but there is no other option available till now and its a quick fix if you want to try.
    – Shubhanshu
    Jan 9, 2020 at 5:50
  • It showing error like Fatal error: Uncaught Error: Undefined class constant 'HASH_VERSION_ARGON2ID13' vendor\magento\framework\Encryption\Encryptor.php on line 215 Jan 31, 2020 at 14:24
  • 1
    You, my man; have saved a life today. Mobsters wanted to hang me for not gettign the site up today but now, because of your extreme knowledge and understanding I may live to fight another day.
    – ItsJhonny
    Jul 8, 2020 at 18:46
  • 1
    Am I crazy, or you basically allowing to login with any password as long as its first log in after migration and email is matching? With $recreated = current(explode(':', $hash)); you are saying compare stored hash to stored hash, ignore password given by user...
    – pbogut
    Oct 4, 2021 at 10:07
1

I have created my own extension for customer migration and that was work perfectly with my Magento version: 2.2.4.

My logic: Taking Magento1 password and appending ":0" before inserting into Magento2 customer table.

Let me know if you need more info for same, I am happy to help the community!

2
  • Is it possible you can share your migration extension and/or logic? Jul 11, 2019 at 13:03
  • please send the link of your extension Jan 31, 2020 at 12:34
1

I appreciate Shubanshu's answer, but as srokatonie stated below it you should never edit files directly in vendor folder.

Instead, create a custom module with an app/code/{CustomModuleVendor}/{CustomModuleNamespace}/etc/di.xml file in it with following content:

<?xml version="1.0"?>
<config xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="urn:magento:framework:ObjectManager/etc/config.xsd">
    <preference for="Magento\Framework\Encryption\Encryptor" type="{CustomModuleVendor}\{CustomModuleNamespace}\Enrcyption\Encryptor" />
</config>

And the app/code/{CustomModuleVendor}/{CustomModuleNamespace}/Encryption/Encryptor.phpfile:

<?php
namespace {CustomModuleVendor}\{CustomModuleNamespace}\Encryption;

class Encryptor extends \Magento\Framework\Encryption\Encryptor {
    const HASH_VERSION_LATEST = "1";

    protected $passwordHashMap = [
        self::PASSWORD_HASH => '',
        self::PASSWORD_SALT => '',
        self::PASSWORD_VERSION => self::HASH_VERSION_LATEST
    ];

    private $hashVersionMap = [
        self::HASH_VERSION_MD5 => 'md5',
        self::HASH_VERSION_SHA256 => 'sha256',
        self::HASH_VERSION_ARGON2ID13 => 'md5'
    ];

   /**
     * @inheritdoc
     */
    public function isValidHash($password, $hash)
    {
        try {
   
            $this->explodePasswordHash($hash);

            foreach ($this->getPasswordVersion() as $hashVersion) {

                if ($hashVersion == '0') {

                    $recreated = current(explode(':', $hash));

                }else if ($hashVersion === self::HASH_VERSION_ARGON2ID13) {
                    $recreated = $this->getArgonHash($password, $this->getPasswordSalt());
                } else {

                    $recreated = $this->generateSimpleHash($this->getPasswordSalt() . $password, $hashVersion);
                }

                $hash = $this->getPasswordHash();
                error_log('password changing technique ======');
                error_log(print_r($recreated,true));
                error_log(print_r($hash,true));
            }
        } catch (\RuntimeException $exception) {
            //Hash is not a password hash.
            $recreated = $this->hash($password);
        }

        return Security::compareStrings(
            $recreated,
            $hash
        );
    }

Make sure to replace all occurences of {CustomModuleVendor} {CustomModuleNamespace} with your module vendor and namespace.

This will use your class intance instead of the core one without changing vendor files (which would be lost when you update your magento framework).

More about using di.xml here

1
  • And with that first login to migrated account can be done with any password, as password here is never checked. A bit unsecure I would say.
    – pbogut
    Oct 7, 2021 at 10:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.