Admin updated user passwords not working after upgrade (Magento 1.7 -> 1.9)

Question

When I change the user passwords after upgrade for some users in the systems > permissions > users edit page and try to login, the passwords do not work.

Looked at the database admin_user and it seems when I change/save the new password that the salt is actually longer than the old passwords. The old salt character(1.7) count was always limited to two characters and the new ones are longer (1.9)

Old salt: :x7
New salt: :t2UMmbI

Old passwords work and continue to work but as soon as I change them in the backend, users cannot login.

Also I tried inserting md5 hash+salt passwords and that via SQL query and that seems to work with two character salt but not with longer ones.

I have checked the sessions, etc and the solutions involving sessions do not seem to have any affect on it.

Any help would be greatly appreciated.

Answer 1

With the help of Fabian Blechschmidt's comment above (who was very close in his answer), I was able to find the solution

The issue was that the Salt itself was too short i.e. getting truncated in the database. In Magento 1.7 the password structure is VARCHAR length = 40 and in Magento 1.8/1.9 VARCHAR length = 100. So something got mixed up in the migration which cut off the password upon save in the admin.

Another post on Reddit also pointed out the change in admin_user database structure: http://www.reddit.com/r/Magento/comments/1rndjj/did_ce18_change_the_way_magento_stores_hashed/

Answer 2

It looks like your password field is too short. The hash is 32 chars long, but yours is only 7. So something went wrong while updating your database.

\Mage_Admin_Model_User::HASH_SALT_LENGTH
const HASH_SALT_LENGTH = 32;

When the salt is too short, magento can not hash the given password with the right has, to get the correct hash to compare them correctly.