Question

I have an old database of users which contains passwords hashed in a way I don’t like.
I’d like for those hashes to be updated to a new hash form (bcrypt) when they log in.

I am using FOSUserBundle to manage users and Elnur’s bcrypt bundle as security encoder. Is there an easy way to plug into the password check mechanism to add this kind of algorithm:

if passwordHash is using old format
  oldFormatHash := hash userGivenPassword in the old way
  if oldFormatHash == passwordHash
     login ok
     update password in database with new hash format
  else
     login ko
else
  use default 

I thought about extending the current security encoder but the isPasswordValid method does not have the id of the account to check (or its canonical name) so the updating part is not available.

Answer 1

In case it can help someone faced with this problem, here is the solution I used.
The old way of storing the passwords in the database did not use salts. So I updated this column to contain the user’s id.

Then it was easy to create my own security encoder using the salt parameter to update the user’s password hashes.