I have an old application (built on .Net C#) includes Users table with hashed passwords sha1(password . salt)
, and I need to migrate this data safely to my new Rails application (which already encrypting passwords using bcrypt-ruby gem
) and looking for the best solution for this issue but with avoiding the following kind of solutions:
I think that the best approach (as I've read) is to let users log into my new app using their old passwords (and I don't know how to do it) and then encrypt their passwords (by BCrypt) and follow the same procedure of newly registered users' password encryption in Rails app.
I appreciate all suggested solutions to solve this issue.
You're on the right track. You need to...
This will allow your users to migrate over time. Then at some point you decide you're going to make the rest go the 'reset password' route or at least start annoying them with email and eventually cut over to bcrypt completely.