User: starksm
Date: 01/12/28 20:32:21
Modified: src/main/org/jboss/security/auth/spi Tag: Branch_2_4
UsernamePasswordLoginModule.java
Log:
Integrate the password hash from main into UsernamePasswordLoginModule
Revision Changes Path
No revision
No revision
1.3.4.5 +110 -12
jbosssx/src/main/org/jboss/security/auth/spi/UsernamePasswordLoginModule.java
Index: UsernamePasswordLoginModule.java
===================================================================
RCS file:
/cvsroot/jboss/jbosssx/src/main/org/jboss/security/auth/spi/UsernamePasswordLoginModule.java,v
retrieving revision 1.3.4.4
retrieving revision 1.3.4.5
diff -u -r1.3.4.4 -r1.3.4.5
--- UsernamePasswordLoginModule.java 2001/11/28 06:10:45 1.3.4.4
+++ UsernamePasswordLoginModule.java 2001/12/29 04:32:21 1.3.4.5
@@ -7,10 +7,11 @@
package org.jboss.security.auth.spi;
import java.io.IOException;
-import java.util.ArrayList;
-import java.util.Enumeration;
+import java.io.UnsupportedEncodingException;
import java.util.Map;
import java.security.Principal;
+import java.security.MessageDigest;
+import java.security.NoSuchAlgorithmException;
import java.security.acl.Group;
import javax.security.auth.Subject;
import javax.security.auth.callback.Callback;
@@ -24,30 +25,45 @@
import org.jboss.security.SimpleGroup;
import org.jboss.security.SimplePrincipal;
+import org.jboss.security.Util;
import org.jboss.security.auth.spi.AbstractServerLoginModule;
-/** An abstract subclass of AbstractServerLoginModule that imposes a
- an identity == String username, credentials == String password view on
- the login process. Subclasses override the getUsersPassword()
- and getUsersRoles() methods to return the expected password and roles
- for the user.
+/** An abstract subclass of AbstractServerLoginModule that imposes
+ * an identity == String username, credentials == String password view on
+ * the login process.
+ * <p>
+ * Subclasses override the <code>getUsersPassword()</code>
+ * and <code>getRoleSets()</code> methods to return the expected password and roles
+ * for the user.
+ *
+ * @see #getUsername()
+ * @see #getUsersPassword()
+ * @see #getRoleSets()
- @see #getUsername()
- @see #getUsersPassword()
- @see #getUsersRoles()
-
@author [EMAIL PROTECTED]
- @version $Revision: 1.3.4.4 $
+ @version $Revision: 1.3.4.5 $
*/
public abstract class UsernamePasswordLoginModule extends AbstractServerLoginModule
{
+ private static final String BASE64_ENCODING = "BASE64";
+ private static final String BASE16_ENCODING = "HEX";
+
/** The login identity */
private Principal identity;
/** The proof of login identity */
private char[] credential;
/** the principal to use when a null username and password are seen */
private Principal unauthenticatedIdentity;
+ /** the message digest algorithm used to hash passwords. If null then
+ plain passwords will be used. */
+ private String hashAlgorithm = null;
+ /** the name of the charset/encoding to use when converting the password
+ String to a byte array. Default is the platform's default encoding.
+ */
+ private String hashCharset = null;
+ /** the string encoding format to use. Defaults to base64. */
+ private String hashEncoding = null;
/** Override the superclass method to look for a unauthenticatedIdentity
property. This method first invokes the super version.
@@ -65,6 +81,22 @@
unauthenticatedIdentity = new SimplePrincipal(name);
super.log.trace("Saw unauthenticatedIdentity="+name);
}
+
+ // Check to see if password hashing has been enabled.
+ // If an algorithm is set, check for a format and charset.
+ hashAlgorithm = (String) options.get("hashAlgorithm");
+ if( hashAlgorithm != null )
+ {
+ hashEncoding = (String) options.get("hashEncoding");
+ if( hashEncoding == null )
+ hashEncoding = BASE64_ENCODING;
+ hashCharset = (String) options.get("hashCharset");
+ if( log.isTraceEnabled() )
+ {
+ log.trace("Passworg hashing activated: algorithm = " + hashAlgorithm +
+ ", encoding = " + hashEncoding+ (hashCharset == null ? "" : "charset
= " + hashCharset));
+ }
+ }
}
/**
@@ -106,6 +138,9 @@
if( identity == null )
{
identity = new SimplePrincipal(username);
+ // Hash the user entered password if password hashing is in use
+ if( hashAlgorithm != null )
+ password = createPasswordHash(username, password);
// Validate the password supplied by the subclass
String expectedPassword = getUsersPassword();
if( validatePassword(password, expectedPassword) == false )
@@ -185,6 +220,69 @@
info[0] = username;
info[1] = password;
return info;
+ }
+
+ /**
+ * If hashing is enabled, this method is called from <code>login()</code>
+ * prior to password validation.
+ * <p>
+ * Subclasses may override it to provide customized password hashing,
+ * for example by adding user-specific information or salting.
+ * <p>
+ * The default version calculates the hash based on the following options:
+ * <ul>
+ * <li><em>hashAlgorithm</em>: The digest algorithm to use.
+ * <li><em>hashEncoding</em>: The format used to store the hashes (base64 or hex)
+ * <li><em>hashCharset</em>: The encoding used to convert the password to bytes
+ * for hashing.
+ * </ul>
+ * It will return null if the hash fails for any reason, which will in turn
+ * cause <code>validatePassword()</code> to fail.
+ *
+ * @param username ignored in default version
+ * @param password the password string to be hashed
+ */
+ protected String createPasswordHash(String username, String password)
+ {
+ byte[] passBytes;
+ String passwordHash = null;
+
+ // convert password to byte data
+ try
+ {
+ if(hashCharset == null)
+ passBytes = password.getBytes();
+ else
+ passBytes = password.getBytes(hashCharset);
+ }
+ catch(UnsupportedEncodingException uee)
+ {
+ log.error("charset " + hashCharset + " not found. Using platform
default.", uee);
+ passBytes = password.getBytes();
+ }
+
+ // calculate the hash and apply the encoding.
+ try
+ {
+ byte[] hash = MessageDigest.getInstance(hashAlgorithm).digest(passBytes);
+ if(hashEncoding.equalsIgnoreCase(BASE64_ENCODING))
+ {
+ passwordHash = Util.encodeBase64(hash);
+ }
+ else if(hashEncoding.equalsIgnoreCase(BASE16_ENCODING))
+ {
+ passwordHash = Util.encodeBase16(hash);
+ }
+ else
+ {
+ log.error("Unsupported hash encoding format " + hashEncoding);
+ }
+ }
+ catch(Exception e)
+ {
+ log.error("Password hash calculation failed ", e);
+ }
+ return passwordHash;
}
/** A hook that allows subclasses to change the validation of the input
_______________________________________________
Jboss-development mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/jboss-development
