How can I import existing users with passwords stored in a different format than Craft's hash format? Se need to import a large user table to a Craft installation. Unfortunately, the passwords in the imported data are SHA1 encrypted (and salted).

What is the best way to enable the login of the users?

We thought that we add an extra column to the table which defined if the hash is standard or SHA1.

If a user logs in where the password is SHA1, then we check if it's the correct password and change it to the standard hash.

This would be the most comfortable way for the existing users.

Question: Is this a possible solution, especially is it possible to hook up into the login process to create the logic for the check.

Or would you recommend other solutions?
Short answer, it can't be done. Possibly with some extensive hacking, but I would highly caution against that.


Directly importing passwords isn't really possible, since the original passwords are unknown.
Adding a custom password column to the database is a bad idea, since Craft user/password management is pretty deeply embedded within the system.


Here's what I would recommend instead... Prompt your users to reset their passwords.

I know this idea doesn't seem ideal initially, but it is not unprecedented. People are used to changing their passwords occasionally, and will generally be very understanding about it. Many folks have dealt with systems that force them to change their password every 3 months, and everyone has forgotten a password at one time or another.

I recently had to do this for a website with several hundred users. We ported from EE to Craft, leaving the front-end visually identical. Here's the message we showed to users after the switch:


  Our login system has recently changed. Please note:
  
  If you haven't logged in since January 10th, you will be required to reset your password.