THIS ANSWER APPLIES TO MAGENTO 1
You do not need to modify Magento's authentication classes.
You can import passwords already MD5 encrypted. I have tested this.
How Magento 1 CE stores passwords:
- Password chosen by user:
- Salt random generated by Magento:
- Password before MD5 encyption:
2sM0lWnxaFoobar! (that is
- Password in MD5 encryption:
- Password stored in database:
b55bd20f0ef25e759dc77b09fe7e4dfd:2sM0lWnxa (that is
How to format already MD5 encrypted password for import (without salt):
- Simply add a
: (colon) to the end of the already MD5 encrypted password
How does this work?
We can see that Magento looks for a
: (colon) in the string, and assumes what comes after it is the
salt. If you place a
: (colon) at the end of your already encrypted password and then nothing further, Magento will realise that there IS no salt for that password.
Getting the password into Magento
Alright, so now we know what we need to do to our passwords, how do we get them into Magento? Normally Magento will automatically encrypt a password you give it, but in our case we DON'T want it to because it's already done.
Turns out, this is simple too! When creating, or updating an existing customer by code you normally use this to set their password:
$customerModel = Mage::getModel("customer/customer");
// ... further code here to create customer (or update existing customer) ...
$customerModel->setPassword("Plain Text Password");
Instead of using the
setPassword method on Customer Model, use
$customerModel->setPasswordHash("<md5 encrypted password>:");