FusionAuth
    • Home
    • Categories
    • Recent
    • Popular
    • Pricing
    • Contact us
    • Docs
    • Login
    1. Home
    2. Tags
    3. hashed password
    Log in to post
    • All categories
    • danD

      Issue with bcrypt on import of users

      Q&A
      • bcrypt password hashed password • • dan
      2
      0
      Votes
      2
      Posts
      1.2k
      Views

      danD

      You'll need to separate out the hash and the salt on the Import API.

      For example, the hash $2a$10$N9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJZdL17lhWy would be split out to the fields:

      factor: 10
      salt: N9qo8uLOickgx2ZMRZoMye
      password: IjZAgcfl7p92ldGxad68LJZdL17lhWy

      The Import API does not parse this value and separate it out for you. You need to do so.

      Here is an example import script (in Ruby): https://github.com/FusionAuth/fusionauth-import-scripts/blob/master/auth0/import.rb#L47

    • danD

      Importing password hashes

      Q&A
      • hashed password import • • dan
      2
      0
      Votes
      2
      Posts
      1.2k
      Views

      danD

      Yes you can. You have a few options.

      If your algorithm matches one of the FusionAuth supported algorithms or one of the community provided ones, you can configure FusionAuth to use it. If not, you may need to write your own hashing plugin.

      Once you have imported the hashes, the next the to consider is whether you want FusionAuth to rehash the passwords as the users log in. This is a good option if the previous hashing algorithm was not a strong one. This is configured at the tenant level, under the Passwords tab.

    • danD

      Creating a user with a hashed password

      Q&A
      • users passwords hashed password • • dan
      2
      0
      Votes
      2
      Posts
      1.1k
      Views

      danD

      Currently the only way to accomplish this will be to use the Import API, as you mentioned: https://fusionauth.io/docs/v1/tech/apis/users#import-users

      We do have an open feature request to allow hashes to be provided on the User API, which I think would be what you're looking for: https://github.com/FusionAuth/fusionauth-issues/issues/348

      Feel free to upvote that issue.