Password hash incompatibility during Ory Kratos lazy migration
0 reputation · 08 Jun 2024, 20:20 UTC
A migration strategy for a small application involves moving identity data to Ory Kratos using a lazy migration approach. The goal is to transition users to the Kratos identity store upon their first successful login without requiring a global password reset.
While Kratos supports standard authentication flows, uncertainty exists regarding the compatibility of legacy password hashes. Specifically, if the source system uses a non-standard bcrypt implementation or a different hashing algorithm, the Kratos authentication API may fail to validate the credentials during the initial migration attempt.
What is the documented behavior for handling non-standard bcrypt hashes during a lazy migration? Does Kratos provide a mechanism to define custom hash verification logic for legacy credentials?