Labs/ForumsMigration

Some quick notes on the migration from SMF -> Vanilla forums for labs.mozilla.com/forum

Passwords Migration

Going with Option 2 below, Store SMF passwords, migrate on user login

• Problem: SMF stores passwords as SHA1+salt, Vanilla (currently) stores as md5 hash. There is of course no way to directly migrate this.

• Note: An upcoming release of Vanilla will rework the password system to use SHA1+salt. The migration solution planned will look for md5 passwords, so we can't store the SMF passwords in the Vanilla password column. http://lussumo.com/community/discussion/8609/vanilla-password-security/#Item_0

• Options:
  • Force all users to reset their password. Effective, very simple, annoying to 6,000+ users
  • Store SMF passwords and migrate on user login. Effective, seamless from user experience, requires modifying core Vanilla code.
    • Set Vanilla password column to junk md5.
    • Store SMF passwords in unique DB column.
    • Modify Vanilla auth class to check this column on user login, if password matches SHA1 table, then rehash as md5 and save to Vanilla password column. *** If we plan on a near future Vanilla upgrade now, then we can plan on wiping out the modified core code, dropping the custom SMF password column, force remaining users to reset their passwords manually, and returning Vanilla to a regular install. The next Vanilla version will rework the Auth class anyway.