diff --git a/docs/user-management/user-migration.mdx b/docs/user-management/user-migration.mdx index 67cbc47f1c7..6f32fd90bba 100644 --- a/docs/user-management/user-migration.mdx +++ b/docs/user-management/user-migration.mdx @@ -104,6 +104,40 @@ The parameters are: } ``` +### Firebase scrypt support \{#firebase-scrypt-support} + +Logto also supports the [modified scrypt algorithm](https://github.com/firebase/scrypt) used by Firebase Authentication. Set `passwordAlgorithm` to `Legacy` and format the `passwordDigest` as follows: + +```json +[ + "firebase-scrypt", + ["salt", "signer_key", "salt_separator", "rounds", "mem_cost", "@"], + "expected_hashed_value" +] +``` + +The parameters are: + +- **`salt`**: The user's `salt` from `firebase auth:export` +- **`signer_key`**, **`salt_separator`**, **`rounds`**, **`mem_cost`**: Your project's password hash parameters, found in the Firebase console under **Authentication** > **Users** > **⋮** > **Password hash parameters** +- **`@`**: Placeholder for the actual password value +- **`expected_hashed_value`**: The user's `passwordHash` from the export, in standard base64. If you read users with the Firebase Admin SDK, convert its URL-safe base64 (`-`, `_`) to standard base64 (`+`, `/`) first. + +`passwordDigest` is limited to 256 characters, so serialize it as compact JSON without spaces (for example, with `JSON.stringify`). + +Users imported into Firebase with a non-scrypt hash who have not signed in since are exported with empty `passwordHash` and `salt`. Import them with their original hash if you still have it, or ask them to reset their password. + +**Example migration payload:** + +```json +{ + "username": "john_doe", + "primaryEmail": "john.doe@example.com", + "passwordAlgorithm": "Legacy", + "passwordDigest": "[\"firebase-scrypt\",[\"42xEC+ixf3L2lw==\",\"jxspr8Ki0RYycVU8zykbdLGjFQ3McFUH0uiiTvC8pVMXAn210wjLNmdZJzxUECKbm0QsEmYUSDzZvpjeJ9WmXA==\",\"Bw==\",\"8\",\"14\",\"@\"],\"lSrfV15cpx95/sZS2W9c9Kp6i/LVgQNDNC/qzrCnh1SAyZvqmZqAjTdn3aoItz+VHjoZilo78198JAdRuid5lQ==\"]" +} +``` + ## Steps to migrate \{#steps-to-migrate} 1. **Prepare the user data**