I have a system with a few thousand user accounts that I need to migrate to a new platform. The system stores a hashed password, not encrypted or (thank goodness) plain text. Also, I don't have the details of the hashing readily available.
What are some effective ways to make the transition? One idea comes to mind off the top of my head:
- Ahead of time, I can migrate all the data. Current users in the old platform will have an account and all their data in the new platform.
- Rip out some of the code that currently handles authentication and turn it into a kind of service that will check the validity of the username/password.
- The new platform can first check it's own authentication to see whether the password has been transferred. If it hasn't, it could call the service on the other platform to determine whether it's valid in the old system.
- If it's not valid, then it tells the user their login was wrong.
- If it is valid, it now knows the correct password and can populate its own user table with the password (according to whatever scheme that platform uses).