Bulk importing Magento users to Auth0, how to handle password_hash?

dan.woda · October 6, 2021, 8:19pm

Hi @ashwin1

Welcome to the Auth0 Community!

Are you using magento 2? This thread goes through a similar issue:

It looks like you can find the missing variables using the strategy outlined in this GitHub issue:

github.com/magento/magento2

Password hash should not rely on system dependant constant

opened 03:21PM - 22 Jul 20 UTC

closed 09:08PM - 10 Feb 21 UTC

cypx

Triage: Dev.Experience Progress: done Issue: ready for confirmation Reported on 2.3.3

### Preconditions (*)  1. Magento 2.3.3 2. PHP 7.2.22 ### Steps to reproduce (*)  1. Fresh Magento install 2. Create some admin and customer accounts 3. Make some system or hardware upgrade on server compiling and running PHP which change Sodium predefined constants https://www.php.net/manual/en/sodium.constants.php 4. Try to login with any account ### Expected result (*) 1. Any admin or customer could login with their current password ### Actual result (*) 1. Admin and customer cannot login with their current password and need to use forgotten password function to get a new one **Temporary workaround** Get constant value from the old server ```bash $ php -r 'echo SODIUM_CRYPTO_SIGN_SEEDBYTES."\n";' 32 $ php -r 'echo SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE."\n";' 4 $ php -r 'echo SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE."\n";' 33554432 ``` Check if they differ on the new server ```bash $ php -r 'echo SODIUM_CRYPTO_SIGN_SEEDBYTES."\n";' 32 $ php -r 'echo SODIUM_CRYPTO_PWHASH_OPSLIMIT_INTERACTIVE."\n";' 2 $ php -r 'echo SODIUM_CRYPTO_PWHASH_MEMLIMIT_INTERACTIVE."\n";' 67108864 ``` On the new server, replace constant by the value from the old server into the sodium_crypto_pwhash function https://github.com/magento/magento2/blob/2.4-develop/lib/internal/Magento/Framework/Encryption/Encryptor.php#L585 User could login again without need to reset their password. --- Please provide [Severity](https://devdocs.magento.com/guides/v2.3/contributor-guide/contributing.html#backlog) assessment for the Issue as Reporter. This information will help during Confirmation and Issue triage processes. - [ ] Severity: **S0** _- Affects critical data or functionality and leaves users without workaround._ - [x] Severity: **S1** _- Affects critical data or functionality and forces users to employ a workaround._ - [ ] Severity: **S2** _- Affects non-critical data or functionality and forces users to employ a workaround._ - [ ] Severity: **S3** _- Affects non-critical data or functionality and does not force users to employ a workaround._ - [ ] Severity: **S4** _- Affects aesthetics, professional look and feel, “quality” or “usability”._

Hope this helps!