In Google's directory API, what hash format is required when "crypt" is provided as the hashFunction for a user?

Question

According to the documentation, hashFunction accepts 'crypt' as a valid value. My problem is figuring out what type of hash this actually is.

A request with a hash generated by PHPs password_hash function (which I understand uses crypt) fails to work.

The request:

The response:

{
 "error": {
  "errors": [
   {
    "domain": "global",
    "reason": "invalid",
    "message": "Invalid Input: $2y$10$qCE0dkXTyFIg6VmqZ/24AuH0Xo5vb8ce3pX9FhRQn5bJzUnAYLax."
   }
  ],
  "code": 400,
  "message": "Invalid Input: $2y$10$qCE0dkXTyFIg6VmqZ/24AuH0Xo5vb8ce3pX9FhRQn5bJzUnAYLax."
 }
}

(The provided hash is generated from the password "hello").

What's an example of a valid hash that Google will accept?

Answer 1

I believe I've figured it out (example passwords are both hello):

• Passwords generated with a DES-based scheme are accepted
  • Example: saPPmoXIbs91M
• Passwords generated with a MD5-based scheme (starting with $1$) are accepted
  • Example: $1$2p5.hs1.$.MKLW7B4Bi.EQMd6agPzO.
• Passwords generated with an SHA-256 or SHA-512 based scheme (starting with $5$ and $6$ respectively) are accepted
• Passwords generated with a Blowfish-based scheme (starting with $2) are not accepted

The accepted hashes are the same type of hash that htpasswd creates using either -m or -d.

Passwords generated with crypt($password) in PHP will be accepted (if you don't specify a salt), but the newer, more secure password_hash($password) will not.