# Adding SSO after many users already signed up -- how to migrate them? **URL:** \ **Category:** SSO\ **Created:** [July 7, 2022, 7:53pm UTC](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240 "2022-07-07T19:53:40Z")\ **Posts on this page:** 1\ **Showing post:** 17
**Author:** ![EGreg](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/egreg/32/133614_2.png) [@EGreg](https://meta.discourse.org/u/EGreg)\ **Post date:** [September 11, 2022, 8:54pm UTC](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240/17 "2022-09-11T20:54:29Z")
> TBH I don’t think Discourse submitting a password over HTTPS is your largest security challenge at this moment. Cute. I see your sha1 and I lower you md5 🙂 [https://news.ycombinator.com/item?id=32796841](https://news.ycombinator.com/item?id=32796841) I see why that pbkdf2 doesn’t really work to split it up… the problem is the first line: ```plaintext U1 = PRF(Password, Salt + INT_32_BE(i)) U2 = PRF(Password, U1) ⋮ Uc = PRF(Password, Uc−1) ``` Any ideas for how to split it up, though? I guess I can just use the pure userland php library: [pbkdf2/src/PBKDF2.php at master · Spomky-Labs/pbkdf2 · GitHub](https://github.com/Spomky-Labs/pbkdf2/blob/master/src/PBKDF2.php) I would recommend to Discourse to hash things with a salt (userId works) before sending the password over the wire. Why not? It doesn’t have to become incompatible with what you are storing in the database now. Simply do the first 100 iterations in Javascript, then subtract 10 from 64000. You have a custom implementation of it anyway (copied from rails) so you’d just send along an `isHashed` variable, and if it’s true, then do the “last” 64K-10 steps only. --- _[View the full topic](https://meta.discourse.org/t/adding-sso-after-many-users-already-signed-up-how-to-migrate-them/232240)._