1

In the process of upgrading a site from 6.2 Update 1 to 8.2 Update 1, it appears the accounts of users are no longer able to log in. The client had a separate "security" database, which looks like a clone of the core database but is tied into the security settings in the config.

One thing one of our developers noticed is that in the original code's web.config (from 6.2), this was the machineKey setting:

<machineKey validationKey="EDDCDC4C5983ACDF268E6DD423F9FF6923E97F630E7C7352CCC48FDA3D6F0D200DC3AADB48BD4954587CF3CBF3170F89303F00D6C9AD6D646AD5DE51EDE8E740,IsolateApps" decryptionKey="EA0CA374099152981504E4E116347F808F33D14293AF2131,IsolateApps" validation="SHA1" />

And in 8.2, this is the setting:

<machineKey validationKey="91903C9C49AF0E10E4915871C5D8F40F494395BEECD034E3BBAEF3A64212C3C3F033D8E03DF1DE239EEC1CF5E4B1E50F91800857CB623CE8927D3961017732ED" decryptionKey="67508682CE1F2321888230909DD8F26D2D8E67C5C42A2C2CBEBB2D4354948DDA" validation="SHA1" decryption="AES" />

I don't know if the machineKey changes could have this affect or if it could be something else deeper in the mechanics of Sitecore, given the range of version changes we're talking about. We also used the migration tool to jump from 6.6 to 8.2, so I don't know if that could have anything to do with it. These were the questions my developer was asking:

"It is my understanding that this machine key is used in encryption and decryption so it would need to remain consistent across the upgrade to have the ability to log into old accounts. The key was clearly changed at some point during the upgrade process, possibly when the automatic upgrade tool was used. Is accessing old accounts as simple as switching in the old machineKey for the new one or does this expose us to future security risks? Are there additional configuration or database changes that are needed to access old accounts? The new machineKey specifies a decryption algorithm, is this compatible with the old key which does not?"

2

In short

Yep. Just switch to previous machine key.

But be aware

That these were updated for a reason. You should look into a migration scenario, moving your user accounts to a more secure form of encryption.

MachineKey and Membership

Essentially, your user passwords are encrypted using the MachineKey configuration settings. This is also why, the MachineKey needs to be the same across multiple servers in your Sitecore setup.

If you use the membership feature, password hashes are stored in the membership database by default. The membership system also supports encrypted passwords. If you select encrypted password format, then the settings are used when encrypting and decrypting the data. If you want to store encrypted passwords, use the following configuration in the Web.config file. Notice that passwordFormat is set to "Encrypted".

Source: How To: Configure MachineKey

Additional

I highly recommend upgrading from your default security setup, to something more appropriate in this day and age. Kam Figy has an excellent article to get you started.

| improve this answer | |
  • Perfect, thanks Mark. I think the machineKey we have in source code isn't what matches their live CM environment, so we're going to check that out, but I agree that security should be upgraded anyway, especially with the recent SHA1 news that even Sitecore is advising updating in the security hardening docs. – Ken McAndrew Jun 23 '17 at 18:34
  • One additional thing I found in going back to the 6.2 machineKey. When I did it and used my MVC-based login page, I got a "decryption key specified has invalid hex characters" due to the "IsolateApps" setting in the key. I found this link: stackoverflow.com/questions/15002960/… - one of the other answers says to add 'compatibilityMode="Framework20SP1"' to the machineKey to get past that issue. Lo and behold, my legacy logins are working now. From here I can look at upgrading security without locking out legacy users. – Ken McAndrew Jun 27 '17 at 13:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.