Import user

[Phillip Weeks]

Might someone explain how to import users through the json import. How does one set the password?

[Jared Wiltshire]

You can set a password by putting {NONE} before the password as shown below. You should make sure the password is changed through the UI after importing as a password set using this method will be stored in plaintext in the database.

{
  "users": [
    {
      "timezone": "",
      "locale": "",
      "homeUrl": "/ui/administration/home",
      "password": "{NONE}myNewPassword123",
      "phone": "",
      "permissions": "",
      "name": "Normal user",
      "receiveAlarmEmails": "IGNORE",
      "receiveOwnAuditEvents": false,
      "disabled": false,
      "muted": true,
      "email": "myuser@yourMangoDomain.com",
      "username": "myuser"
    }
  ]
}

[Phillip Weeks]

Ok Jared that works and mango warns the user about the encryption and asks to update password. But if we wanted to import the password as encrypted to begin with, not having to change it; how is this achieved?
We are sending login id/passwords to a group of users and providing them a password they do not have to update is better in this situation. How do I import an encrypted password?

[Jared Wiltshire]

@phillip-weeks said in Import user:

Ok Jared that works and mango warns the user about the encryption and asks to update password. But if we wanted to import the password as encrypted to begin with, not having to change it; how is this achieved?
We are sending login id/passwords to a group of users and providing them a password they do not have to update is better in this situation. How do I import an encrypted password?

I can definitely look at making Mango hash the password when saving a user if the algorithm is set to {NONE}. In the meantime you could look into generating a BCRYPT hash using a command line tool? You would then import the password as {BCRYPT}hash.

I'm pretty sure any bcrypt command line program should work with our algorithm. We use the Spring class org.springframework.security.crypto.bcrypt.BCrypt to hash the passwords.

[Jared Wiltshire]

@Phillip-Weeks Mango 3.4 (full release. not beta.1) which will be out shortly will have the ability to set plain text passwords with the {PLAINTEXT} prefix. The plain text will be hashed and stored using the default hash algorithm (BCRYPT).

[Phillip Weeks]

That would be fantastic Jared, I tried a few Bcrypt command line tools but could not get one to import. So when should we expect 3.4 release? This week?

[Jared Wiltshire]

Probably early next week but possibly 2 weeks.

Check the start of the hash your command line tool generated, if its $2y$ you can change this to $2a$ and it should work - https://unix.stackexchange.com/a/308024

[Phillip Weeks]

@jared-wiltshire said in Import user:

$2a$

So Jared I successfully imported 72 users for the project. I created a json import file with a hash I got from a bcrypt generator, I copied this modified hash into users json records and everything worked great thanks.

[Jared Wiltshire]

@phillip-weeks Great, glad you got it working. The change I mentioned above will still be making its way into 3.4 so it should be easier next time.