Bulk importing Magento users to Auth0, how to handle password_hash?

[ashwin1]

I am trying to bulk import all of our Magento users into auth0, but I’m not sure how to format the password_hash for auth0 from the argon2id13 format of magento.

Here’s an example of the format that auth0 would want

"custom_password_hash": {
            "algorithm": "argon2",
            "hash": {
                "value": "$argon2id$v=19$m=65536,t=2,p=1$J6Q/82PCyaNpYKRELJyTZg$m04qUAB8rexWDR4+/0f+SFB+4XMFxt7YAvAq2UycYos"
            }
        }

And our magento password_hashes are something like

13a1e806c56a702e21e6568f65f21458ba32d7c1a884d5fc0a54dcfe75783989:AWHUeMyZzlNuuOvb:2

I tried formatting it like the following but that did not properly convert the password:

$argon2id$v=13$m=1024,t=2,p=1$AWHUeMyZzlNuuOvb$13a1e806c56a702e21e6568f65f21458ba32d7c1a884d5fc0a54dcfe75783989

I’m not sure what values to be putting for m, t, p, and I’m assuming what comes after the first semi colon in the Magento hash is the salt. Does anyone know how I should format that full hash?

[dan.woda]

Hi @ashwin1

Welcome to the Auth0 Community!

Are you using magento 2? This thread goes through a similar issue:

Migrating users from Magento2 to Auth0

I am trying to migrate users from my Magneto 2 database to Auth0 I am using the bulk import endpoints (Too new for link). The user passwords are hashed using "Argon 2ID13” algorithm in php. I am reasonably confident the built in php function “sodium_crypto_pwhash” is being used. (Doc found by googling sodium_crypto_pwhash, account to new to link). I’m reasonably confident the implementation of all this within Magneto can be found here (magento2/Encryptor.php at 1c3837ce0183180d40d4c0e0fd0a…

It looks like you can find the missing variables using the strategy outlined in this GitHub issue:

Password hash should not rely on system dependant constant

Hope this helps!

[ashwin1]

Thanks Dan, yes I am using magento 2. I don’t see auth0 mentioned in that thread or how to structure the hash in the format auth0 wants. Am I missing something there?

[dan.woda]

It looks like the SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE and SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE variables mentioned in the github issue may correlate with the iterations (t) and memory size (m), respectively.

I don’t have the tools set up to test this, but it may be helpful if you try and extract those variables to create your hash.