Django导入PHP password_hash()用户密码的平滑迁移策略

# 错误示范：直接赋值会因格式不匹配而无法存储或验证
from django.contrib.auth.models import User

# 假设 old_php_hash 是从PHP数据库中获取的哈希值
old_php_hash = '$2y$10$ZnxKDPbqOfACnGmQeN76o.UtdwWBFBCCLTiGnvCSvl/zqIBeVxhai'

# 尝试直接创建用户或设置密码
# user = User.objects.create_user(username='testguy', email='test@example.com', password=old_php_hash)
# user.password = old_php_hash
# user.save()
# 这种方式将导致密码无法正常工作，Django会认为这是一个无效的密码格式。

# myapp/models.py
from django.contrib.auth.models import AbstractUser
from django.db import models

class CustomUser(AbstractUser):
    # ... 其他字段 ...
    old_password = models.CharField(max_length=128, blank=True, null=True,
                                    help_text="存储从旧PHP系统导入的密码哈希")

    class Meta:
        verbose_name = "用户"
        verbose_name_plural = "用户"

python manage.py makemigrations myapp
python manage.py migrate

# 假设您有一个CSV文件或数据库连接可以获取旧用户数据
# 例如，通过一个管理命令
# myapp/management/commands/import_php_users.py
from django.core.management.base import BaseCommand
from myapp.models import CustomUser # 替换为您的用户模型

class Command(BaseCommand):
    help = 'Imports users and old passwords from a PHP source.'

    def handle(self, *args, **options):
        # 假设这里是从PHP数据库或CSV读取数据的逻辑
        # 这是一个示例数据结构
        php_users_data = [
            {'username': 'user1', 'email': 'user1@example.com', 'php_hash': '$2y$10$ZnxKDPbqOfACnGmQeN76o.UtdwWBFBCCLTiGnvCSvl/zqIBeVxhai'},
            {'username': 'user2', 'email': 'user2@example.com', 'php_hash': '$2y$10$anotherhashvaluehere.anotherhashvaluehere'},
            # ... 更多用户 ...
        ]

        for user_data in php_users_data:
            user, created = CustomUser.objects.get_or_create(
                username=user_data['username'],
                defaults={
                    'email': user_data['email'],
                    'old_password': user_data['php_hash'] # 将PHP哈希存储到old_password
                }
            )
            if not created:
                # 如果用户已存在，更新其old_password
                user.old_password = user_data['php_hash']
                user.save()
                self.stdout.write(self.style.WARNING(f"Updated old_password for user: {user.username}"))
            else:
                self.stdout.write(self.style.SUCCESS(f"Created user: {user.username} with old_password"))

        self.stdout.write(self.style.SUCCESS('User import complete.'))

python manage.py import_php_users

pip install bcrypt

# myapp/backends.py
import bcrypt
from django.contrib.auth.backends import ModelBackend
from django.contrib.auth import get_user_model

class LegacyPHPPasswordBackend(ModelBackend):
    def authenticate(self, request, username=None, password=None, **kwargs):
        UserModel = get_user_model()
        try:
            user = UserModel.objects.get(username=username)
        except UserModel.DoesNotExist:
            return None

        # 1. 首先尝试使用Django的默认密码验证机制
        if user.check_password(password):
            return user
        else:
            # 2. 如果Django默认验证失败，检查是否存在旧的PHP密码哈希
            # 确保用户模型有 old_password 字段
            if hasattr(user, 'old_password') and user.old_password:
                try:
                    # bcrypt.checkpw 期望字节串
                    # 将用户输入的密码和存储的旧哈希转换为字节串进行比较
                    if bcrypt.checkpw(password.encode('utf-8'), user.old_password.encode('utf-8')):
                        # 3. 旧密码匹配成功，将用户密码升级为Django格式
                        user.set_password(password) # 这会将新密码哈希为Django格式
                        user.old_password = None    # 清空旧密码字段，或设置为""
                        user.save()
                        return user
                except ValueError:
                    # 如果 old_password 格式不正确（例如，不是 bcrypt 哈希），
                    # bcrypt.checkpw 会抛出 ValueError，我们捕获它并继续
                    pass
        return None

    def get_user(self, user_id):
        UserModel = get_user_model()
        try:
            return UserModel.objects.get(pk=user_id)
        except UserModel.DoesNotExist:
            return None

# your_project/settings.py

AUTHENTICATION_BACKENDS = [
    'myapp.backends.LegacyPHPPasswordBackend',  # 您的自定义后端
    'django.contrib.auth.backends.ModelBackend', # Django默认后端
]

# 如果您使用了自定义用户模型，还需要指定：
AUTH_USER_MODEL = 'myapp.CustomUser' # 替换为您的用户模型路径