set-passwords

Reads a CMF file and writes a new one in which users have a freshly generated, strong, random password. Use it when you want to import users but have no password hash for them (yet), and the target needs a credential to create the account.

• Every password is generated from the operating system’s secure random source, is different for each user, and contains lowercase and uppercase letters, digits, and symbols. Look-alike characters (0/O, 1/l/I) are left out so a password can be read out.
• Each password is hashed with the --hash algorithm and written to the output file as a portable password, so the target imports it like any other hash.
• The input file is never modified.

By default only users with no password, or a non-portable one (for example a Firebase export made without a hash signer key), get a new password. Users who already have a portable hash keep it. Pass --overwrite to replace those too.

Usage

iamigrate set-passwords --in users.cmf.jsonl.gz --out users-with-passwords.cmf.jsonl.gz \
  --hash bcrypt:cost=10 --passwords-out passwords.csv
iamigrate validate --in users-with-passwords.cmf.jsonl.gz --target kratos

Pick a --hash algorithm the target imports (iamigrate validate reports it when it doesn’t): Auth0 accepts all four; Kratos bcrypt and argon2; Keycloak pbkdf2 and argon2; Firebase bcrypt and scrypt.

Flags

Flag	Description
--in	CMF users.cmf.jsonl.gz or uncompressed users.cmf.jsonl path; gzip is detected automatically (required)
--out	CMF file to write; gzip-compressed when the path ends in .gz, plain JSONL otherwise. Must differ from --in (required)
--hash	How to hash the new passwords: <algo>[:<params>] with algo one of bcrypt | argon2 | pbkdf2 | scrypt, e.g. bcrypt:cost=10 (required). Parameters are the same as for testdata generate
--passwords-out	CSV file to write each new cleartext password to, with the columns source_id, email, username, phone, password. Created with mode 0600 (optional)
--length	Generated password length, 12 to 72 characters (default 24)
--overwrite	Also replace passwords users already have (default: only users with no password or a non-portable one)

The passwords file

Without --passwords-out, the generated passwords are discarded: nobody, including you, can sign in with them, and users have to reset their password. That is the safest choice when users will set their own password through a reset or recovery flow.

With --passwords-out, the cleartext passwords are written to a CSV file so you can hand them out. Treat it as a secret: keep it out of version control, restrict who can read it, and delete it once delivered. Hashing is slow by design, so a very large file takes a while; the progress bar shows how far along it is.

Neither the output file nor the passwords file is left behind if the command fails.

Keeping organizations and roles

import picks up organizations.cmf.jsonl and roles.cmf.jsonl from the directory of the users file. If the target uses them, write --out into the same directory as --in, or copy those files next to the new users file.