Currently migrating members from v7 to v10 using CMSImport but ran into a blocker with passwords. Hash algorithms are different from v7 to v10 so can't migrate the passwords. Has anyone had previous experience of this? Or any type of password decryption?

Think what most people end up doing is resetting all member passwords, whether that is sending bulk emails asking them to reset their password or setting a flag on them that you catch on logins to let them know they need a new password

Passwords are undecryptable. Can't you set the v10 hash algorithm to the v7 one?

@Jemayn yeah, we're now thinking about resetting on first login if we can't migrate the passwords

The benefit is then you can also force them into new and better password complexity requirements 😄

Complexity isnt persé better 😛

Very true, mostly just speaking from experience with lots of old v7 sites that had really low minlength requirements.. I see in the docs that it says atleast the latest v7 defaults to 10 chars, so may have been a deliberate choice on several of the old sites I've worked on..

Long is great, complex.. doesn't matter as much indeed

Ahh that may explain it - just remembering a customer complaining that it wont allow him to use his old password after a migration to a 9+ version.. the password was the zip code he lives in which is a 4 digit number 🙈

😂 omg

I think you can override the

MemberSignInManager

as in https://www.jeroenbreuer.nl/blog/virtual-members-in-umbraco/ and validate passwords with the old algorithm. (Yes, yes, bad idea, etc)

I have an alternative approach. v10 site looks to see if member exists on login. If not - hits an API in the old website I've written with the username and password. If the v7 site can log them in a response with their user details is returned. The v10 site then creates the member - hashes the password supplied and logs the m7 member in. The member has no idea this has happened in the background - there's no messy migration. You obviously need to secure this api and it does mean running a copy of the v7 site in a secure manner out of sight but it works well. (HInt - remember to cover use cases for forgotten passwords).

I also used the same process as Steve, with one minor difference, if the old password failed the new validation criteria it created the new member with a randomly generated password and redirected them to the password reset page