How to perform the migration from 15 to 16 WITHOUT changing the users password?

Questions
1

Your question

Hi

I’ve read the documentation for Vandelay, and the proxy. But as I understand it, this requires me to know the current users password, and setting a new password.

I dont want my users to actually realize that the server has been upgraded, which is impossible unless I tell them that they gotten a new password ?

So how can I perform a proper upgrade without the requirement to know current passwords, and given every user a new password

2

This confirms it directly: the migration guide’s account-recreation step explicitly preserves password hashes, so users never see a password change.

For a 0.15-to-0.16 Stalwart-to-Stalwart migration, the migrate_v015_to_plan.py script (shipped in the proxy repository) reads each account’s password as its stored hash, not the plaintext, and writes that hash into the plan applied with stalwart-cli apply. Because Stalwart recognizes the hash prefix (e.g. $argon2, $6$, $2 for bcrypt, etc.) and stores it verbatim, the user’s original password continues to work unchanged on the new server. You never need to know or reset the actual password.

The overall flow, per account:

  1. Point the admin session at the old server and run migrate_v015_to_plan.py against it, referencing the existing domain ID on the new server. This produces a plan (alice-plan.ndjson) containing the account’s data, aliases, and password hash.
  2. Point the admin session at the new server and apply the plan with stalwart-cli apply --file alice-plan.ndjson, which creates the account with the same hash, so the password carries over silently.
  3. Invalidate caches with stalwart-cli create Action --json '{"@type":"InvalidateCaches"}' so the new account is recognized immediately.
  4. Use Vandelay (vandelay import jmap / vandelay import webdav from the old server, then vandelay export to the new server) to copy mail, mailboxes, sieve scripts, contacts, calendars, and files.
  5. Flip the proxy mapping for that account to the new server, which disconnects and reconnects the user transparently.

This entire procedure is designed so the switch is invisible to the account owner, no password reset is required at any point. Full details: Migrating accounts | Stalwart

This is an automated reply from the Stalwart Help Bot. Other community members may follow up if this answer is incomplete or wrong.

3

You don’t need to know or reset anyone’s password. Vandelay authenticates once with an administrator credential and acts on behalf of each account, so individual passwords never come into it. It also only moves data (mailboxes, mail, sieve scripts, contacts, calendars, files), not credentials, so migrating doesn’t touch passwords at all.

If your users live in an external directory (LDAP, SQL, OIDC), just point the new 0.16 server at the same directory and nobody notices anything. If they’re in Stalwart’s internal directory, recreate each principal carrying over the existing password hash from 0.15 (Stalwart accepts pre-hashed secrets: argon2, bcrypt, pbkdf2, scrypt, sha512-crypt), so their current passwords keep working. One gotcha: after you apply the account-creation plan, invalidate the caches (a documented step) or the new accounts may briefly reject a correct password. Migration docs are at Overview | Stalwart.