feat: add Ory Console guide for password migration hook

[MikeSagnelli]

Summary

• Adds an Ory Console tab to the "Configure a password migration web hook" step in the Import identities guide, with step-by-step instructions and screenshots for setting up the webhook through the Console UI
• Adds a guide for verifying the Migration pending badge on the identity detail page in the "Implement the password migration web hook" step, with a screenshot

The existing Ory CLI instructions are preserved in a second tab.

Related

• Console implementation: https://github.com/ory-corp/cloud/pull/11370

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[wassimoo]

lgtm!

[unatasha8]

Is there a way to verify an identity is pending migration from the CLI?

[MikeSagnelli]

Not directly through the CLI. The ory get identity command has an --include-credentials flag, but its documentation states it only supports oidc.

However, you can verify it through the Admin API by calling:

GET /admin/identities/{id}?include_credential=password

If credentials.password.config.use_password_migration_hook is true and hashed_password is empty, the identity is pending migration.

I can add this as an API example alongside the Console guide if that would be helpful. However, IMO it is not very straightfoward.

[unatasha8]

Is this feature only for Ory Network? If not (or we plan to add to OEL/OSS later), we probably need the verify via Admin API too.

[MikeSagnelli]

This is not a new feature in Ory Network, this is a new feature in Console. We were already able to import identities using the password migration webhook. The only thing that was recently worked on was adding that capability to the Console. Therefore, I believe this is already in OEL/OSS.
In order to check via API if an identity has been successfully migrated, when getting the identity instead of seeing:

{
  "schema_id": "preset://email",
  "traits": {
    "email": "pw-migration@example.org"
  },
  "credentials": {
    "password": {
      "config": {
        "hashed_password": "",
        "use_password_migration_hook": true
      }
    }
  }
}

{
  "schema_id": "preset://email",
  "traits": {
    "email": "pw-migration@example.org"
  },
  "credentials": {
    "password": {
      "config": {
        "hashed_password": "<NON_EMPTY_VALUE>",
      }
    }
  }
}

Let me know if it makes sense to add this.

[unatasha8]

See inline suggestions