FOSUserBundle - Symfony2 login with different encoded password

Question

I have to do a migration of users from an old database where the passwords are stored in MD5, while in the new application using SHA512.

My purpose is that the old users on first login in the new application must change the password but this implies you can load these users from the database with the password in MD5.

How this can be done using Symfony 2.3.3 + FOSUserBundle?

You can read How to create custom password encoder - As a side note, I don't advise you to use sha512 for password encoding. You may want to read How to use Bcrypt to encode password or its compatibility library — Touki
Is possible to load users from the same database discriminating by the type (new / old) and comparing passwords with different encodings? — Angelo Giuffredi
Just encode all your md5 passwords present in your database. On user input, password_verify($raw), if it doesn't match, try with a password_verify(md5($raw)). If it does, update the matching line with password_hash($raw) — Touki
I'm using FOSUserBundle, in which controller or class intercept the loading of users from the database? — Angelo Giuffredi

predic predic · Accepted Answer · 2013-09-27T14:19:24

You could create custom password encoder. For example:

security:
    encoders:
        FOS\UserBundle\Model\UserInterface: { id: my_password_encoder }

Then register that service:

services:
    my_password_encoder:
        class: MyProject\DefaultBundle\Security\PasswordEncoder

and create service with following:

use Symfony\Component\Security\Core\Encoder\BasePasswordEncoder;

class PasswordEncoder extends BasePasswordEncoder
{
    public function encodePassword($raw, $salt)
    {
        return md5($raw);
    }

    public function isPasswordValid($encoded, $raw, $salt)
    {
        return $this->comparePasswords($encoded, $this->encodePassword($raw, $salt));
    }
}

FOSUserBundle - Symfony2 login with different encoded password

3 Answers