Security changes from 6.2 to 8.2

Question

In the process of upgrading a site from 6.2 Update 1 to 8.2 Update 1, it appears the accounts of users are no longer able to log in. The client had a separate "security" database, which looks like a clone of the core database but is tied into the security settings in the config.

One thing one of our developers noticed is that in the original code's web.config (from 6.2), this was the machineKey setting:

<machineKey validationKey="EDDCDC4C5983ACDF268E6DD423F9FF6923E97F630E7C7352CCC48FDA3D6F0D200DC3AADB48BD4954587CF3CBF3170F89303F00D6C9AD6D646AD5DE51EDE8E740,IsolateApps" decryptionKey="EA0CA374099152981504E4E116347F808F33D14293AF2131,IsolateApps" validation="SHA1" />

And in 8.2, this is the setting:

<machineKey validationKey="91903C9C49AF0E10E4915871C5D8F40F494395BEECD034E3BBAEF3A64212C3C3F033D8E03DF1DE239EEC1CF5E4B1E50F91800857CB623CE8927D3961017732ED" decryptionKey="67508682CE1F2321888230909DD8F26D2D8E67C5C42A2C2CBEBB2D4354948DDA" validation="SHA1" decryption="AES" />

I don't know if the machineKey changes could have this affect or if it could be something else deeper in the mechanics of Sitecore, given the range of version changes we're talking about. We also used the migration tool to jump from 6.6 to 8.2, so I don't know if that could have anything to do with it. These were the questions my developer was asking:

"It is my understanding that this machine key is used in encryption and decryption so it would need to remain consistent across the upgrade to have the ability to log into old accounts. The key was clearly changed at some point during the upgrade process, possibly when the automatic upgrade tool was used. Is accessing old accounts as simple as switching in the old machineKey for the new one or does this expose us to future security risks? Are there additional configuration or database changes that are needed to access old accounts? The new machineKey specifies a decryption algorithm, is this compatible with the old key which does not?"

Answer 1

In short

Yep. Just switch to previous machine key.

But be aware

That these were updated for a reason. You should look into a migration scenario, moving your user accounts to a more secure form of encryption.

MachineKey and Membership

Essentially, your user passwords are encrypted using the MachineKey configuration settings. This is also why, the MachineKey needs to be the same across multiple servers in your Sitecore setup.

If you use the membership feature, password hashes are stored in the membership database by default. The membership system also supports encrypted passwords. If you select encrypted password format, then the settings are used when encrypting and decrypting the data. If you want to store encrypted passwords, use the following configuration in the Web.config file. Notice that passwordFormat is set to "Encrypted".

Source: How To: Configure MachineKey

Additional

I highly recommend upgrading from your default security setup, to something more appropriate in this day and age. Kam Figy has an excellent article to get you started.

• Upgrading Sitecore's Password Security with PBKDF2