# Adding SSO after many users already signed up -- how to migrate them?

**URL:** <https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240>\
**Category:** SSO\
**Created:** [July 7, 2022, 7:53pm UTC](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240 "2022-07-07T19:53:40Z")\
**Posts on this page:** 1\
**Showing post:** 12

<div class="post-metadata">

**Author:** ![EGreg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/egreg/32/133614_2.png) [@EGreg](https://meta.discourse.org/u/EGreg)\
**Post date:** [September 4, 2022, 10:17pm UTC](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240/12 "2022-09-04T22:17:36Z")

</div>

Thanks! OK @RGJ a couple quick questions:

The xorcist library is just a faster string xor, right? What if one of the characters ends up being 0 because ‘a’ was xored with ‘a’ – what happens to that string? Aren’t strings null-terminated?

My goal is to port this to PHP, so anything you can do to help (such as giving me info on how to replicate it in PHP) will be very helpful.

Also what is this line doing? `ret.bytes.map { |b| ("0" + b.to_s(16))[-2..-1] }.join("")`

```plaintext
$u = hash_hmac('sha256', $password, $salt . pack('N', 1));
$ret = $u = hash_hmac('sha256', $password, $u);
for ($i=2; $i<$iterations; ++$i) {
  $u = hash_hmac('sha256', $password, $u);
  $ret = ($ret ^ $u);
}
// todo: figure out what RUBY is doing on this last line

```

Is this close? Can you please fix up this PHP code?

---

_[View the full topic](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240)._