diff --git a/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.py b/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.py
new file mode 100644
index 0000000000000000000000000000000000000000..f21c333e09ed629e112711454a2d18d7b71fe007
--- /dev/null
+++ b/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.py
@@ -0,0 +1,24 @@
+
+def migrateInstanceToERP5Login(self):
+  assert self.getPortalType() in ( 'Computer', 'Software Instance')
+
+  login_portal_type = 'ERP5 Login'
+  reference = self.getReference()
+  if not reference:
+    # no user id and no login is required
+    return
+  if not (self.hasUserId() or self.getUserId() == reference):
+    self.setUserId(reference)
+    self.immediateReindexObject()
+
+  if len(self.objectValues(portal_type=login_portal_type)):
+    # already migrated
+    return
+
+  login = self.newContent(
+    portal_type=login_portal_type,
+    reference=reference,
+  )
+
+  login.validate()
+  login.immediateReindexObject()
diff --git a/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.xml b/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.xml
new file mode 100644
index 0000000000000000000000000000000000000000..841b5bb765880fc33e6b15bdd42bd7177f4f7cd4
--- /dev/null
+++ b/master/bt5/slapos_erp5/ExtensionTemplateItem/portal_components/extension.erp5.SlapOSLoginMigration.xml
@@ -0,0 +1,123 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="Extension Component" module="erp5.portal_type"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>_recorded_property_dict</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
+            </value>
+        </item>
+        <item>
+            <key> <string>default_reference</string> </key>
+            <value> <string>SlapOSLoginMigration</string> </value>
+        </item>
+        <item>
+            <key> <string>description</string> </key>
+            <value>
+              <none/>
+            </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>extension.erp5.SlapOSLoginMigration</string> </value>
+        </item>
+        <item>
+            <key> <string>portal_type</string> </key>
+            <value> <string>Extension Component</string> </value>
+        </item>
+        <item>
+            <key> <string>sid</string> </key>
+            <value>
+              <none/>
+            </value>
+        </item>
+        <item>
+            <key> <string>text_content_error_message</string> </key>
+            <value>
+              <tuple/>
+            </value>
+        </item>
+        <item>
+            <key> <string>text_content_warning_message</string> </key>
+            <value>
+              <tuple/>
+            </value>
+        </item>
+        <item>
+            <key> <string>version</string> </key>
+            <value> <string>erp5</string> </value>
+        </item>
+        <item>
+            <key> <string>workflow_history</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAM=</string> </persistent>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="2" aka="AAAAAAAAAAI=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary/>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="3" aka="AAAAAAAAAAM=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary>
+                <item>
+                    <key> <string>component_validation_workflow</string> </key>
+                    <value>
+                      <persistent> <string encoding="base64">AAAAAAAAAAQ=</string> </persistent>
+                    </value>
+                </item>
+              </dictionary>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="4" aka="AAAAAAAAAAQ=">
+    <pickle>
+      <global name="WorkflowHistoryList" module="Products.ERP5Type.patches.WorkflowTool"/>
+    </pickle>
+    <pickle>
+      <tuple>
+        <none/>
+        <list>
+          <dictionary>
+            <item>
+                <key> <string>action</string> </key>
+                <value> <string>validate</string> </value>
+            </item>
+            <item>
+                <key> <string>validation_state</string> </key>
+                <value> <string>validated</string> </value>
+            </item>
+          </dictionary>
+        </list>
+      </tuple>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_erp5_dumb_http_constraint.xml b/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_erp5_dumb_http_constraint.xml
new file mode 100644
index 0000000000000000000000000000000000000000..44a3f3e6f8bd60430f52751ef229c967980102ec
--- /dev/null
+++ b/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_erp5_dumb_http_constraint.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="Script Constraint" module="erp5.portal_type"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>_identity_criterion</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
+            </value>
+        </item>
+        <item>
+            <key> <string>_range_criterion</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAM=</string> </persistent>
+            </value>
+        </item>
+        <item>
+            <key> <string>categories</string> </key>
+            <value>
+              <tuple>
+                <string>constraint_type/post_upgrade</string>
+              </tuple>
+            </value>
+        </item>
+        <item>
+            <key> <string>description</string> </key>
+            <value>
+              <none/>
+            </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>acl_users_erp5_dumb_http_constraint</string> </value>
+        </item>
+        <item>
+            <key> <string>portal_type</string> </key>
+            <value> <string>Script Constraint</string> </value>
+        </item>
+        <item>
+            <key> <string>script_id</string> </key>
+            <value> <string>CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency</string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="2" aka="AAAAAAAAAAI=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary/>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="3" aka="AAAAAAAAAAM=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary/>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_slapos_machine_constraint.xml b/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_slapos_machine_constraint.xml
new file mode 100644
index 0000000000000000000000000000000000000000..b870210caa0ec8a9681a84a73c4fb42989f35e21
--- /dev/null
+++ b/master/bt5/slapos_erp5/PropertySheetTemplateItem/portal_property_sheets/CertificateAuthorityToolConsistencyConstraint/acl_users_slapos_machine_constraint.xml
@@ -0,0 +1,80 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="Script Constraint" module="erp5.portal_type"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>_identity_criterion</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAI=</string> </persistent>
+            </value>
+        </item>
+        <item>
+            <key> <string>_range_criterion</string> </key>
+            <value>
+              <persistent> <string encoding="base64">AAAAAAAAAAM=</string> </persistent>
+            </value>
+        </item>
+        <item>
+            <key> <string>categories</string> </key>
+            <value>
+              <tuple>
+                <string>constraint_type/post_upgrade</string>
+              </tuple>
+            </value>
+        </item>
+        <item>
+            <key> <string>description</string> </key>
+            <value>
+              <none/>
+            </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>acl_users_slapos_machine_constraint</string> </value>
+        </item>
+        <item>
+            <key> <string>portal_type</string> </key>
+            <value> <string>Script Constraint</string> </value>
+        </item>
+        <item>
+            <key> <string>script_id</string> </key>
+            <value> <string>CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency</string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="2" aka="AAAAAAAAAAI=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary/>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+  <record id="3" aka="AAAAAAAAAAM=">
+    <pickle>
+      <global name="PersistentMapping" module="Persistence.mapping"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>data</string> </key>
+            <value>
+              <dictionary/>
+            </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.py b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.py
new file mode 100644
index 0000000000000000000000000000000000000000..5af86ca8389d5197686595dafc36c1a79bd28ebf
--- /dev/null
+++ b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.py
@@ -0,0 +1,11 @@
+acl_users = context.getPortalObject().acl_users
+plugin_id = 'erp5_dumb_http_extraction'
+error_list = []
+if plugin_id not in acl_users.objectIds():
+  error_list.append('ERP5 Dumb HTTP Extraction Plugin does not exist as %s/%s' % (acl_users.getPath(), plugin_id))
+  if fixit:
+    acl_users.manage_addProduct['ERP5Security'].addERP5DumbHTTPExtractionPlugin(plugin_id)
+    getattr(acl_users, plugin_id).manage_activateInterfaces([
+      'IExtractionPlugin'
+    ])
+return error_list
diff --git a/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.xml b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.xml
new file mode 100644
index 0000000000000000000000000000000000000000..06321abcb894ff0fe537e5711df12cf146c7f31e
--- /dev/null
+++ b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>Script_magic</string> </key>
+            <value> <int>3</int> </value>
+        </item>
+        <item>
+            <key> <string>_bind_names</string> </key>
+            <value>
+              <object>
+                <klass>
+                  <global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
+                </klass>
+                <tuple/>
+                <state>
+                  <dictionary>
+                    <item>
+                        <key> <string>_asgns</string> </key>
+                        <value>
+                          <dictionary>
+                            <item>
+                                <key> <string>name_container</string> </key>
+                                <value> <string>container</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_context</string> </key>
+                                <value> <string>context</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_m_self</string> </key>
+                                <value> <string>script</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_subpath</string> </key>
+                                <value> <string>traverse_subpath</string> </value>
+                            </item>
+                          </dictionary>
+                        </value>
+                    </item>
+                  </dictionary>
+                </state>
+              </object>
+            </value>
+        </item>
+        <item>
+            <key> <string>_params</string> </key>
+            <value> <string>fixit=False</string> </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>CertificateAuthorityTool_checkERP5DumbHTTPExtractorExistenceConsistency</string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.py b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.py
new file mode 100644
index 0000000000000000000000000000000000000000..3f6befcb40583435687ef2b5f3eec721a9e9a781
--- /dev/null
+++ b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.py
@@ -0,0 +1,17 @@
+portal = context.getPortalObject()
+acl_users = portal.acl_users
+plugin_id = 'slapos_machine'
+error_list = []
+if plugin_id not in acl_users.plugins.getAllPlugins(plugin_type='IExtractionPlugin')['active']:
+  error_list.append('SlapOS Machine Authentication Plugin is desactive as %s/%s' % (acl_users.getPath(), plugin_id))
+  if fixit:
+    tag = 'slapos_login_migration'
+    portal.portal_catalog.activate(tag=tag, activity='SQLQueue').searchAndActivate(
+      portal_type=('Computer', 'Software Instance'),
+      activate_kw={'tag': tag, 'priority': 6},
+      method_id='Instance_migrateToERP5Login',
+    )
+    getattr(acl_users, plugin_id).manage_activateInterfaces([
+      'IExtractionPlugin'
+    ])
+return error_list
diff --git a/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.xml b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.xml
new file mode 100644
index 0000000000000000000000000000000000000000..cb85220bf3ff7bf7ad9fc09e6f1c37350749738b
--- /dev/null
+++ b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency.xml
@@ -0,0 +1,62 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="PythonScript" module="Products.PythonScripts.PythonScript"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>Script_magic</string> </key>
+            <value> <int>3</int> </value>
+        </item>
+        <item>
+            <key> <string>_bind_names</string> </key>
+            <value>
+              <object>
+                <klass>
+                  <global name="NameAssignments" module="Shared.DC.Scripts.Bindings"/>
+                </klass>
+                <tuple/>
+                <state>
+                  <dictionary>
+                    <item>
+                        <key> <string>_asgns</string> </key>
+                        <value>
+                          <dictionary>
+                            <item>
+                                <key> <string>name_container</string> </key>
+                                <value> <string>container</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_context</string> </key>
+                                <value> <string>context</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_m_self</string> </key>
+                                <value> <string>script</string> </value>
+                            </item>
+                            <item>
+                                <key> <string>name_subpath</string> </key>
+                                <value> <string>traverse_subpath</string> </value>
+                            </item>
+                          </dictionary>
+                        </value>
+                    </item>
+                  </dictionary>
+                </state>
+              </object>
+            </value>
+        </item>
+        <item>
+            <key> <string>_params</string> </key>
+            <value> <string>fixit=False</string> </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>CertificateAuthorityTool_checkSlapOSMachineNonExistenceConsistency</string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/Instance_migrateToERP5Login.xml b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/Instance_migrateToERP5Login.xml
new file mode 100644
index 0000000000000000000000000000000000000000..5ee935df82b37861a747abdfbe9af7e32b23fd4c
--- /dev/null
+++ b/master/bt5/slapos_erp5/SkinTemplateItem/portal_skins/slapos_erp5/Instance_migrateToERP5Login.xml
@@ -0,0 +1,28 @@
+<?xml version="1.0"?>
+<ZopeData>
+  <record id="1" aka="AAAAAAAAAAE=">
+    <pickle>
+      <global name="ExternalMethod" module="Products.ExternalMethod.ExternalMethod"/>
+    </pickle>
+    <pickle>
+      <dictionary>
+        <item>
+            <key> <string>_function</string> </key>
+            <value> <string>migrateInstanceToERP5Login</string> </value>
+        </item>
+        <item>
+            <key> <string>_module</string> </key>
+            <value> <string>SlapOSLoginMigration</string> </value>
+        </item>
+        <item>
+            <key> <string>id</string> </key>
+            <value> <string>Instance_migrateToERP5Login</string> </value>
+        </item>
+        <item>
+            <key> <string>title</string> </key>
+            <value> <string></string> </value>
+        </item>
+      </dictionary>
+    </pickle>
+  </record>
+</ZopeData>
diff --git a/master/bt5/slapos_erp5/bt/template_extension_id_list b/master/bt5/slapos_erp5/bt/template_extension_id_list
index eda9c07d217d04e7cccc56616f3965f080ce1cbf..e63d55241b9d5b224a9ce43235ef2f017982dde2 100644
--- a/master/bt5/slapos_erp5/bt/template_extension_id_list
+++ b/master/bt5/slapos_erp5/bt/template_extension_id_list
@@ -1 +1,2 @@
-extension.erp5.SlapOSCheckConsistency
\ No newline at end of file
+extension.erp5.SlapOSCheckConsistency
+extension.erp5.SlapOSLoginMigration
\ No newline at end of file