Validate Symfony 2 passwords in Rails 4

Question

I have to import an users table from Symfony 2 to a Rails 4 app. All users must log in the new rails app using Devise with their old passwords.

What I have done at the moment is as follows:

class User < ActiveRecord::Base
  alias :devise_valid_password? :valid_password?

  def valid_password?(password)
    salt = self.salt
    begin
      devise_valid_password?(password)
    rescue BCrypt::Errors::InvalidHash
      return false unless Digest::SHA512.hexdigest("#{salt}:#{password}") == encrypted_password
      logger.info "User #{email} is using the old password hashing method, updating."
      self.password = password
      self.salt = nil
      self.save
      true
    end
  end
end

Basically I'm testing if the password suplied is valid for Devise using BCrypt, if not it checks againts SHA512 with salt. Salt was previously imported into the database together with the encrypted old password. If this last check works, it stores the password with BCrypt.

The problem is that I'm not getting the correct encrypted password with SHA512. I don't know how Symfony 2 handles the password - salt for the encryption algorithm, and had no success reading the docs.

Into the Symfony app in security.yml, it's written:

encoders:
    Foo\BarBundle\Entity\User:
        algorithm:   sha512
        iterations: 1
        encode_as_base64: false

Anyone could say what is the correct statement for this line to work as Symfony 2 does?

Digest::SHA512.hexdigest("#{salt}:#{password}")

Thanks.

EDIT

Working thanks to Nextar answer. Gist: https://gist.github.com/CV-Gate/840f2bc1ded9ed642b5f

Nextar Nextar · Accepted Answer · 2014-06-26T05:32:41

may this helps:

Symfony uses a specific method to combine the salt and encode the password before
comparing it to your encoded password. If getSalt() returns nothing, then the submitted 
password is simply encoded using the algorithm you specify in security.yml. If a salt is 
specified, then the following value is created and then hashed via the algorithm:



$password.'{'.$salt.'}';

So may you hash the password in the wrong order? Sorry I'm not familiar with ruby but Digest::SHA512.hexdigest("#{salt}:#{password}") seems not to be the same like $password.'{'.$salt.'}'; in php

Validate Symfony 2 passwords in Rails 4

1 Answers