Redmine

• After switching the setting:
  • logging in rehashes the password with the new algorithm, on the first login only.
  • changing the password hashes it with the new algorithm.
  • a user added after the switch has their password hashed with the new algorithm.
• The down migration of users.hashed_password:
  • is refused with the number of affected users while Argon2id hashes exist, e.g. 3 user(s) have passwords hashed with Argon2id, reset them with SHA1 first.
  • succeeds once all the users have been rehashed with SHA-1 by switching the setting to sha1 and logging in.

I manually verified the behavior as follows.

Setup: change the password_hash_algorithm setting from unset to argon2id¶

redmine-app(dev):007> User.order(:id).pluck(:id, :login, :hashed_password)
  User Pluck (27.4ms)  SELECT "users"."id", "users"."login", "users"."hashed_password" FROM "users" WHERE "users"."type" = $1 ORDER BY "users"."id" ASC  [["type", "User"]]
=>
[[1, "admin", "584d{snip}"],
 [5, "user01", "4c8a{snip}"]]

Change the setting: password_hash_algorithm: argon2id

ShowHide

vscode ➜ /workspaces/redmine (master-yuya-devcontainer-use_argon2id_for_password_hash_algorithm-refacto
r_split_algorithms) $ git diff
diff --git a/config/configuration.yml b/config/configuration.yml
index d787b178b..c8202c924 100644
--- a/config/configuration.yml
+++ b/config/configuration.yml
@@ -23,6 +23,7 @@ development:
   # .devcontainer/post_create_command.d/30-database narrows down to these two.
   scm_git_path_regexp: '/.+'
   scm_subversion_path_regexp: '(file:///|https?://|svn://|svn\+ssh://).+'
+  password_hash_algorithm: argon2id

 production:
   email_delivery:
@@ -33,3 +34,4 @@ production:

   scm_git_path_regexp: '/.+'
   scm_subversion_path_regexp: '(file:///|https?://|svn://|svn\+ssh://).+'
+  password_hash_algorithm: argon2id

redmine-app(prod):002> Redmine::PasswordHash.current_algorithm
=> Redmine::PasswordHash::Argon2id
redmine-app(prod):003> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1, "admin", "584d{snip}"],
 [4, "", ""],
 [5, "user01", "4c8a{snip}"]]

Restart Redmine to apply the change:

ShowHide

yuya@kijinmaru|14:48:06|0|13.7% docker restart nishidayuya-redmine-bb23faba-web-1

Verification: Argon2id is applied on login, on password change and to a new user¶

Log in as user01:

redmine-app(prod):005> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1, "admin", "584d{snip}"],
 [4, "", ""],
 [5,
  "user01",
  "$argon2id$v=19$m=19456,t=2,p=1$sNsW{snip}"]]

Change the password of admin:

redmine-app(prod):007> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1,
  "admin",
  "$argon2id$v=19$m=19456,t=2,p=1$gyVB{snip}"],
 [4, "", ""],
 [5,
  "user01",
  "$argon2id$v=19$m=19456,t=2,p=1$sNsW{snip}"]]

Add user02:

redmine-app(prod):009> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1,
  "admin",
  "$argon2id$v=19$m=19456,t=2,p=1$gyVB{snip}"],
 [4, "", ""],
 [5,
  "user01",
  "$argon2id$v=19$m=19456,t=2,p=1$sNsW{snip}"],
 [6,
  "user02",
  "$argon2id$v=19$m=19456,t=2,p=1$4wrb{snip}"]]

Verification: the down migration is refused while users with Argon2id hashes exist¶

Running the down migration raises ActiveRecord::IrreversibleMigration:

vscode ➜ /workspaces/redmine (master-yuya-devcontainer-use_argon2id_for_password_hash_algorithm-refacto
r_split_algorithms) $ bin/rails db:migrate:down VERSION=20261026000000
== 20261026000000 ChangeUsersHashedPasswordLimit: reverting ===================
bin/rails aborted!
StandardError: An error has occurred, this and all later migrations canceled: (StandardError)

3 user(s) have passwords hashed with Argon2id, reset them with SHA1 first

/workspaces/redmine/db/migrate/20261026000000_change_users_hashed_password_limit.rb:11:in 'ChangeUsersHashedPasswordLimit#down'
{... backtraces}
/workspaces/redmine/vendor/bundle/ruby/4.0.0/gems/bootsnap-1.26.0/lib/bootsnap/load_path_cache/core_ext/kernel_require.rb:33:in 'Kernel#require'

Caused by:
ActiveRecord::IrreversibleMigration:  (ActiveRecord::IrreversibleMigration)

3 user(s) have passwords hashed with Argon2id, reset them with SHA1 first

/workspaces/redmine/db/migrate/20261026000000_change_users_hashed_password_limit.rb:11:in 'ChangeUsersHashedPasswordLimit#down'
{... backtraces}
/workspaces/redmine/vendor/bundle/ruby/4.0.0/gems/bootsnap-1.26.0/lib/bootsnap/load_path_cache/core_ext/kernel_require.rb:33:in 'Kernel#require'
Tasks: TOP => db:migrate:down
(See full trace by running task with --trace)

Verification: the down migration succeeds without users with Argon2id hashes¶

Revert the setting to the default.

And current states:

redmine-app(prod):001> Redmine::PasswordHash.current_algorithm
=> Redmine::PasswordHash::Sha1
redmine-app(prod):002> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1,
  "admin",
  "$argon2id$v=19$m=19456,t=2,p=1$gyVB{snip}"],
 [4, "", ""],
 [5,
  "user01",
  "$argon2id$v=19$m=19456,t=2,p=1$sNsW{snip}"],
 [6,
  "user02",
  "$argon2id$v=19$m=19456,t=2,p=1$4wrb{snip}"]]

Restart Redmine:

ShowHide

yuya@kijinmaru|15:06:59|0|13.7% docker restart nishidayuya-redmine-bb23faba-web-1

Log in again as all the three users on the Redmine web UI:

redmine-app(prod):003> User.order(:id).pluck(:id, :login, :hashed_password)
=>
[[1, "admin", "4a64{snip}"],
 [4, "", ""],
 [5, "user01", "9b50{snip}"],
 [6, "user02", "578b{snip}"]]

Running the down migration finishes successfully:

vscode ➜ /workspaces/redmine (master-yuya-devcontainer-use_argon2id_for_password_hash_algorithm-refacto
r_split_algorithms) $ bin/rails db:migrate:down VERSION=20261026000000
== 20261026000000 ChangeUsersHashedPasswordLimit: reverting ===================
-- change_column(:users, :hashed_password, :string, {limit: 40, default: "", null: false})
   -> 0.0248s
== 20261026000000 ChangeUsersHashedPasswordLimit: reverted (0.0761s) ==========