# Migrating from homegrown auth. to RESTful Authentication

**URL:** <https://www.ruby-forum.com/t/migrating-from-homegrown-auth-to-restful-authentication/164499>\
**Category:** Rails\
**Created:** [April 1, 2009, 11:36pm UTC](https://www.ruby-forum.com/t/migrating-from-homegrown-auth-to-restful-authentication/164499 "2009-04-01T23:36:38Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [April 1, 2009, 11:36pm UTC](https://www.ruby-forum.com/t/migrating-from-homegrown-auth-to-restful-authentication/164499/1 "2009-04-01T23:36:38Z")

</div>

I’m trying to port an existing, home grown authentication system to use  
RESTful Authentication (and then RoleRequirement on top of that).

I am concerned about how best to handle the existing user data in my  
users table so that legacy (pre-RESTful Auth users) can log in.

I already have an existing users table with salt and hashed versions of  
passwords, so I’m assuming that I will simply have to have a way to  
detect which user records are pre-existing and ensure that I run the MD5  
against them the “legacy” way.

Obviously, all new user records end up with the RESTful Auth. hashing  
method applied to their passwords.

I’m looking for advice from anyone who has had to do this type of  
conversion before.

Thanks,  
Wes

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [April 2, 2009, 9:39am UTC](https://www.ruby-forum.com/t/migrating-from-homegrown-auth-to-restful-authentication/164499/2 "2009-04-02T09:39:15Z")

</div>

If you are happy with the security of your original hashing then you  
could  
just patch restful auth to use your existing technique.

2009/4/1 Wes G. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)

---

<div class="post-metadata">

**Author:** ![weyus](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/w/7ab992/32.png) [@weyus](https://www.ruby-forum.com/u/weyus)\
**Post date:** [April 2, 2009, 2:34pm UTC](https://www.ruby-forum.com/t/migrating-from-homegrown-auth-to-restful-authentication/164499/3 "2009-04-02T14:34:18Z")

</div>

> I’m looking for advice from anyone who has had to do this type of  
> conversion before.
> 
> Thanks,  
> Wes

One way could be to allow users to reset the password by requesting a  
token sent by email. So that everybody will be forced to update their  
passwords. You’ll have to make it super clear so that users won’t get  
upset seeing they can’t log in anymore.