Create a new module with the following Django password hasher to handle ASP.net (sha1) passwords:
import hashlib
import base64
from django.contrib.auth.hashers import (BasePasswordHasher, mask_hash)
from django.utils.datastructures import SortedDict
from django.utils.encoding import force_bytes
from django.utils.crypto import constant_time_compare
from django.utils.translation import ugettext_noop as _
def utf16tobin(s):
return s.encode('hex')[4:].decode('hex')
class MSSHA1PasswordHasher(BasePasswordHasher):
"""
ASP.NET hasher
"""
algorithm = "mssha1"
def encode(self, password, salt):
assert password is not None
assert salt and '$' not in salt
pwdenc = password.encode('utf16')
pwdenc = utf16tobin(pwdenc)
saltdecode = base64.b64decode(salt)
m = hashlib.sha1()
m.update(saltdecode)
m.update(pwdenc)
hash = base64.b64encode(m.digest())
return "%s$%s$%s" % (self.algorithm, salt, hash)
def verify(self, password, encoded):
algorithm, salt, hash = encoded.split('$', 2)
assert algorithm == self.algorithm
encoded_2 = self.encode(password, salt)
return constant_time_compare(encoded, encoded_2)
def safe_summary(self, encoded):
algorithm, salt, hash = encoded.split('$', 2)
assert algorithm == self.algorithm
return SortedDict([
(_('algorithm'), algorithm),
(_('salt'), mask_hash(salt, show=2)),
(_('hash'), mask_hash(hash)),
])
Add the module name to your settings file in the PASSWORD_HASHERS list (see https://docs.djangoproject.com/en/1.4/topics/auth/ for details).
Migrate the ASP.net salt and password into the Django password field like this:
user.password = "mssha1$" + old_membership.passwordsalt + "$" + old_membership.password
Users can then login to your Django app with their existing ASP.net passwords. Once they've logged in successfully, Django will automatically upgrade their passwords to the latest algorithm, e.g. PBKDF2.