Dear all,
we are running an OpenStack deployment Caracal on AlmaLinux 9.7 and we are attempting the upgrade to Epoxy release.

Our cloud has been running since 2018, and over the years we have performed several release updates (Rocky-Train-Yoga-Caracal) without modifying the default value for the parameter "password_hash_algorithm" in the keystone.conf file

During the update to Epoxy, Keystone shows an error in /var/log/httpd/keystone_wsgi_internal_error.log  that seems related to the deprecation of older encryption algorithms

026-03-13 15:31:15.359556 ValueError: Unsupported password hashing algorithm ident: $6$
2026-03-13 15:31:17.703201 mod_wsgi (pid=32730): Exception occurred processing WSGI script '/usr/bin/keystone-wsgi-public'.
2026-03-13 15:31:17.703935 Traceback (most recent call last):
2026-03-13 15:31:17.703966   File "/usr/lib/python3.9/site-packages/keystone/common/password_hashing.py", line 72, in _get_hasher_from_ident
2026-03-13 15:31:17.703972     return _HASHER_IDENT_MAP[hashed[0 : hashed.index('$', 1) + 1]]
2026-03-13 15:31:17.703994 KeyError: '$6$'

In our db there are some passwords starting with "$6$round....".

Do you any have suggestions about how to modify the encryption algorithm for these passwords to $2$? Is there a keystone script to perform this migration and fix the error?

Thanks,

cheers

   Federica

-- 
Federica Fanzago
INFN Sezione di Padova
Via Marzolo, 8
35131 Padova - Italy

Tel: +39 049.967.7367 
--