Django集成PHP password_hash()密码：用户平滑迁移策略

# myapp/models.py

from django.contrib.auth.models import AbstractUser
from django.db import models

class CustomUser(AbstractUser):
    # 现有字段...
    old_password = models.CharField(max_length=255, blank=True, null=True, help_text="用于存储从旧PHP系统导入的密码哈希值")

    # 可以添加其他自定义字段
    # 例如：phone_number = models.CharField(max_length=15, blank=True, null=True)

    class Meta:
        verbose_name = '用户'
        verbose_name_plural = '用户'

# 确保在settings.py中配置AUTH_USER_MODEL = 'myapp.CustomUser'

python manage.py makemigrations myapp
python manage.py migrate

# import_users.py (示例脚本)

import csv
from django.contrib.auth import get_user_model
from django.db import transaction

# 确保已安装bcrypt: pip install bcrypt
import bcrypt

User = get_user_model()

def import_php_users(csv_file_path):
    with open(csv_file_path, 'r', encoding='utf-8') as file:
        reader = csv.DictReader(file)
        users_to_create = []
        for row in reader:
            username = row['username']
            email = row['email']
            php_hashed_password = row['php_password_hash'] # 假设CSV中包含PHP哈希密码

            # 创建用户，将PHP哈希密码存储到old_password字段
            # 注意：这里不设置Django的password字段，或者可以设置一个临时密码
            # 也可以先不设置password字段，让其在首次登录时由Django生成
            user = User(
                username=username,
                email=email,
                old_password=php_hashed_password
            )
            users_to_create.append(user)

        with transaction.atomic():
            User.objects.bulk_create(users_to_create, ignore_conflicts=True) # 忽略重复用户
            print(f"成功导入 {len(users_to_create)} 位用户。")

if __name__ == '__main__':
    # 假设您的CSV文件路径
    import_php_users('path/to/your/php_users.csv')

pip install bcrypt

# myapp/backends.py

from django.contrib.auth.backends import ModelBackend
from django.contrib.auth import get_user_model
import bcrypt # 导入bcrypt库

class PHPMigrationBackend(ModelBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        User = get_user_model()
        try:
            user = User.objects.get(username=username)
        except User.DoesNotExist:
            return None

        # 1. 尝试使用Django的默认密码验证机制
        if user.check_password(password):
            return user
        else:
            # 2. 如果Django默认验证失败，检查old_password字段
            if user.old_password and user.old_password != "":
                try:
                    # bcrypt.checkpw 期望字节串
                    # 将明文密码和存储的哈希密码转换为字节串进行比较
                    if bcrypt.checkpw(password.encode('utf-8'), user.old_password.encode('utf-8')):
                        # 3. 如果旧密码验证成功，更新用户密码为Django格式
                        user.set_password(password) # 这将使用Django当前的哈希算法重新哈希密码
                        user.old_password = "" # 清空旧密码字段
                        user.save()
                        return user
                except ValueError:
                    # 如果old_password格式不正确，bcrypt可能会抛出ValueError
                    # 此时不进行处理，让认证失败
                    pass
            return None # 密码不匹配

    def get_user(self, user_id):
        User = get_user_model()
        try:
            return User.objects.get(pk=user_id)
        except User.DoesNotExist:
            return None

# your_project/settings.py

AUTHENTICATION_BACKENDS = [
    'myapp.backends.PHPMigrationBackend', # 您的自定义后端
    'django.contrib.auth.backends.ModelBackend', # Django的默认后端
]

# 如果您使用了自定义用户模型，请确保也配置了它
AUTH_USER_MODEL = 'myapp.CustomUser' # 替换为您的应用名和模型名