Support firebase/google identity platform scrypt import

Feedback
1

Feature: Allow import from firebase authentication for seamless migration

Description: Firebase uses a modified way of scrypt, therefore the standard scrypt support auth0 offers is not sufficient. for more info: Not able to use with Crypto.scrypt in NodeJS · Issue #2 · firebase/scrypt · GitHub

Use-case: We would like to migrate from firebase to auth0. Of course rolling migration may be an option, however. An import would be the best option in our opinion to minimize the migration effort.

2

Thanks for creating this feedback card. Hope it gets some traction from other users!

3

I concur; being able to migrate users in a single bulk import would be much easier to manage and would not require the Firebase project to continue to be deployed in order for those users to sign in. This seems like a big win to attract customers who are migrating from or expanding beyond their existing Firebase apps.

I request for Auth0 to add a new firebase_scrypt algorithm for Bulk Import that took the same parameters as the current scrypt algorithm with two modifications:

  • replace cost with Firebase’s config value mem_cost, and calculate the scrypt cost as 2^mem_cost
  • add a project_signing_key parameter to add the symmetric signing key for the Firebase project.

Auth0 could then validate the incoming password in the local database and update the password hash on the next sign in.

Also note, that the other request about scrypt mentions Firebase in the request, and it was closed as completed by Auth0 implementing the standard scrypt algorithm. However, this is still not compatible with Firebase’s algorithm (which was pointed out in yet another thread).

The solution to original request has high SEO and is misleading. It is also closed, so I can’t reply to it, but I would appreciate if someone from Auth0 updated it to note that Firebase hashes are not currently supported, and direct users to this feature request instead.

Please also update the Auth0 Firebase incompatibility announcement post to direct users to this feature request directly. Currently it links to a generic product feedback page, which then redirects to a broken search (doesn’t filter on feedback properly by default) so you can’t easily find this feature request.

1 Like