Hey! I’m currently looking into making the switch from Django user management to Ory Kratos for the startup I work for. We want to preserve the passwords of our users by using the hashed password method that you provide, however I am struggling to make it work. Our Django setup uses pbkdf2-sha256 and I have worked on a migration that assigns the hash,salt, length and iteration into the format you have defined so that we can push our identities over. However, I cannot get it to work. I cloned your repo and wrote my own test case with a test password and hash, and still face issues. Anyone who is available to debug?

Hello Andreas, are you able to share your code so we can reproduce? Otherwise I have it on my list to create a hands-on guide for migrating identities. Also pinging @damp-sunset-69236 since he has much more experience with Django.

For sure:

def decode_hash(encoded):
    algorithm, iterations, salt, hash = encoded.split("$", 3)
    return f"$pbkdf2-sha256$i={iterations},l=32${salt}${hash}"


def push_identities_to_kratos(apps, schema_editor):
    User = apps.get_model("customers", "User")

    headers = {
        "Authorization": "Bearer ory_pat_xxxxxxxxxxxxxxxxxxxxxxxx",
        "Content-Type": "application/json",
    }
    failed_users = []

    for user in User.objects.all():
        payload = {
            "schema_id": "5b46b51c87f515485905a12d82494e5bceb13e50118d53d7902a4cbae442186afc5df852f4df49589e768780e49fae46a369c3a1d97a7127f3b2dcb4413795c2",
            "traits": {
                "email": user.email,
                "name": {
                    "first": user.first_name,
                    "last": user.last_name,
                },
            },
            "credentials": {
                "password": {"config": {"hashed_password": decode_hash(user.password)}}
            },
        }
        response = <http://requests.post|requests.post>(
            "<https://myprojectkeythingy.projects.oryapis.com/admin/identities>",
            json=payload,
            headers=headers,
        )
        data = response.json()
        errors = data.get("error")
        if errors:
            failed_users.append(user.id)
            logger.warn(
                f"Failed to migrate user to Kratos ({user.email})", error=errors
            )

can you create the same hash through kratos (e.g. using unit tests) and compare it?

I tried doing this:

func TestComparepbkdf2hash(t *testing.T) {
	assert.Nil(t, hash.Compare(context.Background(), []byte("admin123"), []byte("$pbkdf2-sha256$i=216000,l=32$pknum4sl85ri$pbkdf2_sha256$216000$pknum4sl85ri$g+8PPmkWp9/090lEd0MpxIjYu4d3HGPvPopkS3LaW1w=")))
}

yes it would make sense

So with the hash provided in this test, it will fail. But if I strip the hash-part of the string for "="-padding then I get a hash

[131 239 15 62 105 22 167 223 244 247 73 68 119 67 41 196 136 216 187 135 119 28 99 239 62 138 100 75 114 218 91 92]

from the fn

hash, err = base64.RawStdEncoding.Strict().DecodeString(parts[4])

https://pkg.go.dev/encoding/base64#pkg-variables

RawStdEncoding is the standard raw, unpadded base64 encoding, as defined in RFC 4648 section 3.2. This is the same as StdEncoding but omits padding characters.

Yeah, I took a look at those docs. However I had a hard time understanding how to achieve that same setup in Python

What hash does kratos produce when hashing that password with the same parameters and salt? does that match as a string or is it completely different?

If I just print out the

otherHash

variable in the compare-func then I get a different hash

hm so it is completely different 🤔

I think I found the issue

ok I see, then probably in your pyhton code you have to encode the salt one more time

Sorry for wasting your time here. Apparently, Django does not base64-encode the salt. So by encoding it before inserting it in the string it works

I assume it is already base64 encoded, but you can just encode it a second time

yep

np, it is a good takeaway because other people might want to do the same at some point, and we can now write a guide for that

Yep, I ended up with something looking like this:

def convert_django_to_kratos_hash(encoded):
    _, iterations, salt, hash = encoded.split("$", 3)
    encoded_salt = base64.b64encode(salt.encode("UTF-8")).decode("UTF-8")
    stripped_hash = hash.replace("=", "")
    return f"$pbkdf2-sha256$i={iterations},l=32${encoded_salt}${stripped_hash}"

thanks a lot