we have an (old) Java Web-Application, using Shiro – works like a charm – since ages 😉

What we need is the possibility to “reset” an existing user PW from an PHP application (lets call it the “Admin-Tool”).

As Shiro is using – in our case – sha-256 & 500000 rounds & a salt,
I thought i can use PHP’s crypt function, but …

./java -jar shiro-tools-hasher-1.4.0-RC2-cli.jar -ngs -s 1234567890123456 -d -p
        Password to hash:       <-- a
        
        $shiro1$SHA-256$500000$MTIzNDU2Nzg5MDEyMzQ1Ng==$le2T939sZTe4upbz0wct6NAjtxVmpM+Bl7UAoW+wJi4=

and with PHP’s crypt function

>>> crypt('a','$5$rounds=500000$1234567890123456$')
=> "$5$rounds=500000$1234567890123456$vx0mjR6hsoTYlO37/QObVyFIlVZ/ikTMIwyl/035wf."

(the first 5 – according to the docs – points to sha-256)

Question: what am i doing wrong? And even of more interest .. how to do it the correct way?

Thank you.