)]}'
{"keystone/common/sql/data_migration_repo/versions/046_migrate_old_password_data_to_password_hash_column.py":[{"author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"change_message_id":"8442d3c28575b3c509496ad699a42991f714bbf5","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    with migrate_engine.begin() as conn:"},{"line_number":23,"context_line":"        stmt \u003d password_table.update().where("},{"line_number":24,"context_line":"            password_table.c.password_hash \u003d\u003d expression.null()).values("},{"line_number":25,"context_line":"            {\u0027password_hash\u0027: password_table.c.password})"},{"line_number":26,"context_line":"        conn.execute(stmt)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_bc49d232","line":25,"updated":"2018-06-21 19:53:38.000000000","message":"So this copies whatever is in the old hash column to the new hash column, right? Keystone knows how to handle all those \"legacy\" hash types, right?","commit_id":"6663ea9a4758dc4ffe62bd4147a0a5cda37302ce"},{"author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"change_message_id":"b5b0c5ba233435fa424757b90cfa694418ec55e2","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    with migrate_engine.begin() as conn:"},{"line_number":23,"context_line":"        stmt \u003d password_table.update().where("},{"line_number":24,"context_line":"            password_table.c.password_hash \u003d\u003d expression.null()).values("},{"line_number":25,"context_line":"            {\u0027password_hash\u0027: password_table.c.password})"},{"line_number":26,"context_line":"        conn.execute(stmt)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_454d0d70","line":25,"in_reply_to":"5f7c97a3_73a3409c","updated":"2018-06-25 17:52:25.000000000","message":"The hash types are prefixed, so it looks like\n\n$\u003cident\u003e$\u003cmetadata\u003e$\u003chash\u003e\n\nand Ident is something like \"bcrypt\" or \"scrypt\". We will forever support validating a password with sha256, but as of Pike it was impossible to hash new passwords with sha256.\n\nIt\u0027s standard for the hashing lib. This simply copies the data from the old column to the new column *if* the new column is not populated.\n\nIt allows us to drop the old code in Stein, when we build the contract that drops the password column and we only have the password_hash column going forward.","commit_id":"6663ea9a4758dc4ffe62bd4147a0a5cda37302ce"},{"author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"change_message_id":"6ecf6bc7bbbcd846b673e23832a3780864545e6d","unresolved":false,"context_lines":[{"line_number":22,"context_line":"    with migrate_engine.begin() as conn:"},{"line_number":23,"context_line":"        stmt \u003d password_table.update().where("},{"line_number":24,"context_line":"            password_table.c.password_hash \u003d\u003d expression.null()).values("},{"line_number":25,"context_line":"            {\u0027password_hash\u0027: password_table.c.password})"},{"line_number":26,"context_line":"        conn.execute(stmt)"}],"source_content_type":"text/x-python","patch_set":1,"id":"5f7c97a3_73a3409c","line":25,"in_reply_to":"5f7c97a3_bc49d232","updated":"2018-06-25 10:46:55.000000000","message":"I think so. it looks keystone still supports the old format for verifying. https://github.com/openstack/keystone/blob/master/keystone/common/password_hashing.py#L32","commit_id":"6663ea9a4758dc4ffe62bd4147a0a5cda37302ce"}]}