Thanks @pfaffman
I’ve done some testing and can confirm that it doesn’t work with Drupal 7, which apparantly uses SHA-512 according to Drupal 7: Secure password storage by default at last | Jon Cave
I’ll create a PR if I’m able to add a compatible one.
Rich
Hello 
I migrated a whole lot of content from bbPress over to my discourse installation. I can see all posts and users and stuff. But my users can’t login using their “old” password data from my WP site. I installed the plugin, its listed in my plugin section of my admin area. I checked all the available check marks.
Still: nobody can login!
I also have no idea where to apply the given code from the plugin’s readme:
user = User.find_by(username: 'user')
user.custom_fields['import_pass'] = '5f4dcc3b5aa765d61d8327deb882cf99'
user.save
Also I have no idea what exactly is meant by alternative password hashes talked about in the readme.
@michaeld could you provide some more guidance on how to use the plugin?
As far as I recall the bbpress importer supports the plugin, so you did everything right and that is all you would need to do.
Oh my god, after some more testing it turned out that it actually worked. The problem was a changed password when I tested it 
Sorry! Thanks for the great plugin! Made my life a lot easier!
Hi, I’m having problems making this work. I’ve created a custom field import_pass and installed the plugin. Ran the import script once again on my SMF database but with no luck, no one can login afterwards. On the custom field I can see just a “-“ instead of some hash.
Like other users pointed out before, not sure what do with this:
user = User.find_by(username: 'user')
user.custom_fields['import_pass'] = '5f4dcc3b5aa765d61d8327deb882cf99'
user.save
Appreciate any guidance Does this code go in the smf2.rb import script file or what?
That won’t work. But there is no need to install the plugin during import, or to create a custom field manually. It should be handled by the SMF2 script already. So something else is up.
The code is there as an example for script authors. It’s already in the SMF2 script.
Thanks. That’s great. So you mean, if I remove the manually created custom field and just keep the plugin activated, then it should work by itself and pick up the password hashes when it needs too.
Is there a log we can check to see why the plugin isn’t doing what is supposed to?
The plugin takes care of interpreting and using the custom fields that have been set by the importer. If the custom fields are empty or not there, then it is not an issue with the plugin, but an issue with the importer.
Should the plugin be installed before or after the migration? Or it doesn’t change anything?
TL;DR: after.
You should install the plugin on the instance that is actually running the migrated forum.
We have seen instances where the plugin caused issues when it was installed on an instance that was actually running the migration script, so we recommend against installing it there.
Hi,
Has anyone tested with password hashes from Auth0?
I can’t just test because their password hash export is a paid customer service, just wanted to know if anyone tried before going this route myself.
Looks like their passwords are hashed using bcrypt with 10 salt rounds.
Thanks.
Hi there, by any chance has anything changed regarding Drupal 7 support?
Whoops, 2 year old question that I missed!
bcrypt should be supported regardless of the number of rounds, as long as the rounds are encoded in the usual way ($2a$10$...)
No, that code has not been touched in over 3 years.
몇 년 전에 migratepassword 플러그인을 사용하여 포럼을 Discourse로 이전했습니다. 이전 포럼의 레거시 비밀번호 해시를 여전히 사용 중인 사용자의 수를 확인할 방법이 있을까요?
기술적으로 말하면, 사용자가 레거시 비밀번호 해시를 "사용"하는 것은 아닙니다.
마이그레이션 이후 사용자가 처음 로그인할 때, 입력한 비밀번호가 Discourse 비밀번호(초기에는 무작위 문자열입니다)와 일치하지 않으면 플러그인이 작업을 수행합니다.
import_pass 커스텀 필드와 일치하는지, 플러그인이 아는 모든 해시 방법을 사용하여 확인합니다.import_pass 커스텀 필드를 삭제합니다.따라서 몇 년이 지난 후에는 마이그레이션된 비밀번호를 사용하여 로그인하지 않은 사용자만 import_pass 커스텀 필드가 남아 있게 됩니다.
a) 로그인한 적이 없는 경우 (마지막 확인 날짜로 확인할 수 있습니다)
b) 마이그레이션된 비밀번호 대신 이메일, 다른 인증 방법 또는 비밀번호 재설정을 사용하여 로그인한 경우
방금 a) 상황 b가 보안 문제를 초래할 수 있다는 사실을 깨달았습니다. 사용자가 비밀번호를 기억하지 못하여 비밀번호를 변경하거나 다른 인증 방법을 사용하는 경우, 마이그레이션된 비밀번호 해시가 여전히 남아 있어 새 비밀번호와 함께 사용될 수 있습니다. 이 문제를 해결하기 위해 플러그인을 업데이트하여 모든 성공적인 로그인 시 import_pass 커스텀 필드를 지우도록 수정했습니다.
따라서 앞으로는 로그인한 적 없는 사용자만 import_pass 커스텀 필드가 남아 있게 됩니다.