在.NET Core Identity种子数据中禁用PasswordHash自动生成的方法

我用EF Core给IdentityUser表配置种子数据，代码如下：

public void Configure(EntityTypeBuilder<IdentityUser> builder)
{
  var hasher = new PasswordHasher<IdentityUser>();
  var adminUser = new IdentityUser
  {
    Id = Id,
    UserName = AdminUserName,
    NormalizedUserName = AdminUserName,
    Email = AdminUserName,
    NormalizedEmail = AdminUserName,
    EmailConfirmed = true,
    ConcurrencyStamp = ConcurrencyStamp,
    SecurityStamp = SecurityStamp
  };

  adminUser.PasswordHash = hasher.HashPassword(adminUser, Password);
  
  builder.HasKey(u => u.Id);
  builder.Property(u => u.Id).ValueGeneratedNever();
  builder.Property(u => u.ConcurrencyStamp).ValueGeneratedNever();
  builder.Property(u => u.PasswordHash).ValueGeneratedNever();
  builder.Property(u => u.SecurityStamp).ValueGeneratedNever();

  builder.HasData(adminUser);
}

首次迁移一切正常，但即使没做任何修改，创建第二次迁移时，总会生成修改PasswordHash的操作，生成的迁移代码如下：

public partial class UserAndRoleSeed3 : Migration
{
    /// <inheritdoc />
    protected override void Up(MigrationBuilder migrationBuilder)
    {
        migrationBuilder.UpdateData(
            schema: "Users",
            table: "AspNetUsers",
            keyColumn: "Id",
            keyValue: "0fbad743-9b2c-4eac-aa17-957880a5465d",
            column: "PasswordHash",
            value: "AQAAAAIAAYagAAAAELfdYk76pRqQjoKQM9cOrCEplDXzB2mFhQdaCByEIBU4ng6fb9FtK7rY6sCLKwhS8A==");
    }

    /// <inheritdoc />
    protected override void Down(MigrationBuilder migrationBuilder)
    {
        migrationBuilder.UpdateData(
            schema: "Users",
            table: "AspNetUsers",
            keyColumn: "Id",
            keyValue: "0fbad743-9b2c-4eac-aa17-957880a5465d",
            column: "PasswordHash",
            value: "AQAAAAIAAYagAAAAELG0nqfYzxLsa3gKh8PlUIx23oUZOe4RJjrk1DRPSdYvdkDqoQsTVhCApmGOx0awVw==");
    }
}

如何避免这个迁移问题？

1. 预先生成固定密码哈希并硬编码 #

PasswordHasher.HashPassword每次生成的哈希会包含随机盐值，导致每次运行迁移时生成的哈希值不一致，EF Core会判定数据发生变化。

解决方法：先手动生成一次目标密码的哈希值，将结果直接硬编码到种子数据中，替换动态生成逻辑：

public void Configure(EntityTypeBuilder<IdentityUser> builder)
{
  var adminUser = new IdentityUser
  {
    Id = Id,
    UserName = AdminUserName,
    NormalizedUserName = AdminUserName,
    Email = AdminUserName,
    NormalizedEmail = AdminUserName,
    EmailConfirmed = true,
    ConcurrencyStamp = ConcurrencyStamp,
    SecurityStamp = SecurityStamp,
    // 直接使用预先生成的固定哈希值
    PasswordHash = "AQAAAAIAAYagAAAAELfdYk76pRqQjoKQM9cOrCEplDXzB2mFhQdaCByEIBU4ng6fb9FtK7rY6sCLKwhS8A=="
  };
  
  builder.HasKey(u => u.Id);
  builder.Property(u => u.Id).ValueGeneratedNever();
  builder.Property(u => u.ConcurrencyStamp).ValueGeneratedNever();
  builder.Property(u => u.PasswordHash).ValueGeneratedNever();
  builder.Property(u => u.SecurityStamp).ValueGeneratedNever();

  builder.HasData(adminUser);
}

2. 禁用EF Core对PasswordHash字段的变化检测 #

如果不想硬编码哈希值，可以通过配置让EF Core忽略该字段的种子数据变化。注意：后续若需更新密码哈希，需手动处理迁移：

// 在Configure方法中添加
builder.Entity<IdentityUser>().Metadata.FindProperty(nameof(IdentityUser.PasswordHash))
    .SetAfterSaveBehavior(PropertySaveBehavior.Ignore);

3. 改用应用启动时的初始化逻辑替代EF Core种子数据 #

EF Core的HasData设计用于静态初始数据，不适合动态生成的内容（如带随机盐的密码哈希）。可以在应用启动时检查并创建管理员用户，完全避开迁移文件的干扰：

// 在Program.cs中添加（需确保已注入UserManager）
var scope = app.Services.CreateScope();
var userManager = scope.ServiceProvider.GetRequiredService<UserManager<IdentityUser>>();

var adminUser = await userManager.FindByIdAsync(Id);
if (adminUser == null)
{
    adminUser = new IdentityUser
    {
        Id = Id,
        UserName = AdminUserName,
        NormalizedUserName = AdminUserName,
        Email = AdminUserName,
        NormalizedEmail = AdminUserName,
        EmailConfirmed = true,
        ConcurrencyStamp = ConcurrencyStamp,
        SecurityStamp = SecurityStamp
    };
    await userManager.CreateAsync(adminUser, Password);
}

该逻辑仅在应用首次启动时创建用户，后续启动不会重复执行，也不会影响迁移文件。

内容的提问来源于stack exchange，提问作者Sgri