In the process of upgrading a site from 6.2 Update 1 to 8.2 Update 1, it appears the accounts of users are no longer able to log in. The client had a separate "security" database, which looks like a clone of the core database but is tied into the security settings in the config.
One thing one of our developers noticed is that in the original code's web.config (from 6.2), this was the machineKey setting:
<machineKey validationKey="EDDCDC4C5983ACDF268E6DD423F9FF6923E97F630E7C7352CCC48FDA3D6F0D200DC3AADB48BD4954587CF3CBF3170F89303F00D6C9AD6D646AD5DE51EDE8E740,IsolateApps" decryptionKey="EA0CA374099152981504E4E116347F808F33D14293AF2131,IsolateApps" validation="SHA1" />
And in 8.2, this is the setting:
<machineKey validationKey="91903C9C49AF0E10E4915871C5D8F40F494395BEECD034E3BBAEF3A64212C3C3F033D8E03DF1DE239EEC1CF5E4B1E50F91800857CB623CE8927D3961017732ED" decryptionKey="67508682CE1F2321888230909DD8F26D2D8E67C5C42A2C2CBEBB2D4354948DDA" validation="SHA1" decryption="AES" />
I don't know if the machineKey changes could have this affect or if it could be something else deeper in the mechanics of Sitecore, given the range of version changes we're talking about. We also used the migration tool to jump from 6.6 to 8.2, so I don't know if that could have anything to do with it. These were the questions my developer was asking:
"It is my understanding that this machine key is used in encryption and decryption so it would need to remain consistent across the upgrade to have the ability to log into old accounts. The key was clearly changed at some point during the upgrade process, possibly when the automatic upgrade tool was used. Is accessing old accounts as simple as switching in the old machineKey for the new one or does this expose us to future security risks? Are there additional configuration or database changes that are needed to access old accounts? The new machineKey specifies a decryption algorithm, is this compatible with the old key which does not?"