1

I have Migrated Magento 1.9.1.0 website in Magento 2.2.4,all data is migrated successfully.

When I am trying to login from front-end with existing old customer(Magento1) it generating error

"You did not sign in correctly or your account is temporarily disabled."

While it is working fine for Newly creating customers in Magento 2.

I have debugged in Database customer_entity table and found that old Magento 1 was using SHA1 for password hashing and its length is "40" + salt = 73 character.Since magento 1 default using MD5 technique but in our Magento code old developers override core file and changed below code

class CD_Core_Model_Encryption extends Mage_Core_Model_Encryption
{
    /**
     * Hash a string
     *
     * @param string $data
     * @return string
     */
    public function hash($data)
    {
        return sha1($data);
    }
}

Hence all passwords in Magento 1 saved in SHA1 format.

passwords are after migrated

6de015050ee16e5451019072f77f2bf50c3c02bc:VLAyPWtkZsHa00UMCWrFNtJ1ARoBp4Wc

Above password are not accepted in Magento 2 when login

Please help anybody how to support SHA1 password in Magento 2.

1

I think you are aware of possible solutions But let me clarify it:

Solution 1: Easy Quick Solution

what alan Storm Suggested:- enter image description here

  1. Ask your customer to change password by sending them reset password link.
  2. Reset all Password Manually or by script & send them.

How you can do that: (put in root folder & run script for send password reset link to all customers)

include('app/bootstrap.php'); // add bootstrap file

use Magento\Framework\App\Bootstrap;
use Magento\Customer\Api\AccountManagementInterface;
use Magento\Customer\Model\AccountManagement;

$bootstrap = Bootstrap::create(BP, $_SERVER);
$objectManager = $bootstrap->getObjectManager(); 

$state = $objectManager->get('Magento\Framework\App\State');
$state->setAreaCode('frontend'); 

$_customers = $objectManager->create('Magento\Customer\Api\AccountManagementInterface');
$customerCollection = $objectManager->create('Magento\Customer\Model\ResourceModel\Customer\Collection');
$customerCollection->load();   // get customers
$i = 0;
foreach ($customerCollection as $customers) {

    $email = $customers->getData('email');

    try {
            $_customers->initiatePasswordReset($email, AccountManagement::EMAIL_RESET);
        } catch (NoSuchEntityException $e) {
            // Do nothing, we don't want anyone to use this action to determine which email accounts are registered.
        } catch (\Exception $exception) {
            echo __('We\'re unable to send the password reset email.');
        }
        echo "<pre>";
        echo $i . " Email :-" . $email . " Mail Sent";

    $i++;
}

Solution 2. ( Not Recommended but also work)

Hash algorithm can not change from one to another (md5 to sh1/sh2). Magento2 doesn't support SHA1 (deprecated)

Hashing algorithms are one-way i.e. They cannot be reversed unlike Encryption-Decryption algorithms.

you can't get back string(password) But you can check same hash value by brute force.

Magento 1.x has stored password similar to

password =353dc2ba6108461cf3468184bdd0e174:LM => md5($password.$salt):salt.

Pseudo code

if( md(5) [password [1].userenteredpasswd])==password [0])
{
# User Authenticated
}

in your case

6de015050ee16e5451019072f77f2bf50c3c02bc:VLAyPWtkZsHa00UMCWrFNtJ1ARoBp4Wc

sh1(md5($password.$salt)):sha1(salt)

As Magento2 store in this way

5ca6a208eba1be74251419d22399925c01fbe36f72c5b472d110c40c119b8709:QTwASvDZV6kKPNCl8eHZGZfF1U8NaoRB:1

hash('SHA-256', $salt . $password):$salt:1

Hash Value:(random 32 bit character):(Hashing algorithm version default:1)

  • MD5 produces 128 bit(16 byte) hash value(supported by magento 1.x , 2.x).
  • SHA-1 produces 160 bit hash value.
  • SHA-2(SHA-256) produces 256 bit hash value(supported by magento 2.x).

What you have to do now: authenticate users by extra step and also save in similar manner.

Pseudo code

if( sh2(sh1(md(5) [password [1].userenteredpasswd])))==password [0])
    {
    # User Authenticated
    }

Want to change in core files to support SHA1?

it's hashing password and encrypt/decrypt library using cryptographic algorithms. https://github.com/magento/magento2/blob/2.2-develop/lib/internal/Magento/Framework/Encryption/Encryptor.php

                 or

write a plugin for extra authenticate step

for \Magento\Customer\Api\AccountManagementInterface::authenticate(). check this https://github.com/magento/magento2/blob/2.2-develop/app/code/Magento/Customer/Api/AccountManagementInterface.php

  • Hi @lalit,In which function we will require to write above condition if( sh2(sh1(md(5) [password [1].userenteredpasswd])))==password [0]) in file path vendor/magento/framework/Encryption/Encryptor.php ? – akgola Aug 22 '18 at 5:45
  • @akgola I don't know exactly how you hash & encrypt your password in magento1 based on match that hash value with my generated hash (SHA-1) I confirm it's sha-1. Can you create user in ur modified m1 and share with me hash value so I can create on my system to check solution works.(update also core file changes). – lalit mohan Aug 22 '18 at 7:51
  • @akgola getHash and hash – lalit mohan Aug 22 '18 at 10:19
  • Hello @lalit, Please share updated function so we can implement it properly. – akgola Aug 27 '18 at 7:20
  • @akgola Please write a plugin for custom authentication. Don't change core files as it will make big trouble in future upgrade. There's no shortcuts to solve problems. it will take efforts if you want me to write plugin for you give me some time .. I will update soon.. – lalit mohan Aug 29 '18 at 10:48
0

Magento2 by default uses Sha256 for encryption.

Refer to link

You can review the same in the file Encryptor.php located at vendor\magento\framework\Encryption

One way you can do it override the file using preference method like shown here and change the encryption format to sha1.

You can further Refer to public function getHash and public function hash

A way out for you to allow existing customers access can be to use plugin method like Sinisa mentioned here extending \Magento\Customer\Model\Authentication. You can also use the plugin created by him and change the md5 hash to sha1. There may be other ways to counter the situation, but I think this can work too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.