By: Edgar Saavedra user 17 May 2023 at 1:24 p.m. CDT

4 Responses
Edgar Saavedra gravatar
Hi, I am trying to migrate some users from my database in LDAP, I am getting the correct information, the problem is that when I import them to auth0 when I try to verify the user's session it appears that the password is invalid. What data should I add so that auth0 matches the hash handled by the LDAP database?

By Aliaksandr Samuseu staff 18 May 2023 at 8:48 a.m. CDT

Aliaksandr Samuseu gravatar
Hi, Edgar. Keep in mind that passwords are not normally stored in cleartext in LDAP, but instead their salted hashes. So direct import into some different db won't work, unfortunately.

By Edgar Saavedra user 18 May 2023 at 10:43 a.m. CDT

Edgar Saavedra gravatar
I am carrying out migration tests, I would like to know what kind of encryption the passwords have and how I could integrate it with auth0, I understand that the passwords are hashed, my question is how can I migrate my users without losing their passwords and that they work in auth0?

By Aliaksandr Samuseu staff 18 May 2023 at 1:31 p.m. CDT

Aliaksandr Samuseu gravatar
The problem is that isn't encryption, but literally a hash - an irreversible digital footprint, not a real password. At least, this is how everything is set up by default. In the past questions like yours were asked, and basically there are two strategies: 1. Transfer your users without passwords, then use whatever capabilities your new platform has to ask them to configure new passwords for their accounts on their first login 2. Reconfigure OpenDJ in such way it will store passwords that can be later extracted, or add a new attribute to your user entries which will carry a copy of user's password you can use later. But that needs to be done BEFORE your users are enrolled to the system As of now, you only have option one, I'm afraid.

By Aliaksandr Samuseu staff 18 May 2023 at 1:34 p.m. CDT

Aliaksandr Samuseu gravatar
Their is also option 3) but it's only available if you migrate from one Gluu Server to another; or at least to something that also uses OpenDJ as db. You could transfer all required OpenDJ configuration items (including salt) to the new server, and then it should be able to work with password hashes originally generated on the first server. But as you migrate them to some entirely else environment this is of no use.