You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@struts.apache.org by msg2ajay <ms...@gmail.com> on 2007/11/13 05:15:10 UTC
what login security&encription are good for struts...?
hello friends,
I am developing a struts+hibernate application which
contains a login page. I am not sure of which tools or API's to use for
logn
Authentication and encription.
Can any bady suggest me which is best for login Authentication and what way
can i proceed for secured login for WebApplication.
Ajay
--
View this message in context: http://www.nabble.com/what-login-security-encription-are-good-for-struts...--tf4795666.html#a13719503
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: what login security&encription are good for struts...?
Posted by Ingo Villnow <in...@googlemail.com>.
Hello,
i had the same task and I did the following:
- my loginAction starts a method loginService. My service method calls
the dao (for example userDAO) to get the encrypted password, which is
saved in the database. Now my service method calls a method to encrypt
the form given password (i take the password, concat it with a salt
value and build a 64Bit encoded SHA-1 Hash). Then I check if the
encrypted form password is similar to the encrypted password in the user
database.
Greetz
some code:
public class LoginService {
public LoginService() {
}
public Employee getUserCredentials(String username) {
Employee user;
EmployeeDAO dao = new EmployeeDAO();
ArrayList userlist = (ArrayList) dao.findByWinlogonname(username);
if (userlist.size() == 0) {
try {
userlist = (ArrayList) dao.findByPersonnelnumber(new Long(
username));
if (userlist.size() == 0) {
return null;
} else {
user = (Employee) userlist.get(0);
return user;
}
} catch (NumberFormatException e) {
return null;
}
} else {
user = (Employee) userlist.get(0);
return user;
}
}
public int authenticate(String formUsername, String formPassword) {
Employee user;
user = new Employee();
user = this.getUserCredentials(formUsername);
if (user != null) {
String formPasswordHash = PasswordHash.generate64BaseHashcode(
formPassword, user.getSaltvalue());
System.out.println("HASH: "+formPasswordHash);
if (user.getPasswordhash().compareTo(formPasswordHash) == 0) {
return 1;
} else {
return -1;
}
} else {
return 1;
}
}
}
public class PasswordHash {
public PasswordHash() {
}
public static String generateSaltValue(){
BigInteger saltInt = new BigInteger(128,new Random());
String saltStr = saltInt.toString();
return saltStr;
}
public static String generate64BaseHashcode(String password, String
saltValue) {
String hashValue = null;
String pwWithSalt = saltValue.concat(password);
try {
// Saltwert einbauen - siehe Unix-Passwortverwaltung
MessageDigest md = MessageDigest.getInstance("SHA");
md.update(pwWithSalt.getBytes("UTF-8"));
byte[] pwWithSaltRAW = md.digest();
hashValue = new BASE64Encoder().encode(pwWithSaltRAW);
return hashValue;
} catch (java.security.NoSuchAlgorithmException nsae) {
System.err.println(nsae.toString()
+ ": Konnte String nicht verschlüsseln!");
} catch (UnsupportedEncodingException e) {
e.printStackTrace();
}
return hashValue;
}
}
public class LoginAction extends Action {
public ActionForward execute(ActionMapping mapping, ActionForm form,
HttpServletRequest request, HttpServletResponse response) {
LoginForm lf = new LoginForm();
lf = (LoginForm) form;
LoginService userlogin = new LoginService();
int succeeded = userlogin.authenticate(lf.getUsername(), lf
.getPassword());
Employee user;
if (succeeded == 1) {
user = userlogin.getUserCredentials(lf.getUsername());
HttpSession session = request.getSession();
session.setAttribute("username", user.getForename() + " "
+ user.getSurname());
session.setAttribute("employee", user);
return mapping.findForward("showhome");
} else {
ActionMessages errormessages = new ActionMessages();
errormessages.add(ActionMessages.GLOBAL_MESSAGE, new
ActionMessage(
"loginform.errors.login"));
switch (succeeded) {
case -1:
errormessages.add(ActionMessages.GLOBAL_MESSAGE,
new
ActionMessage("loginform.errors.falsepassword"));
break;
case -2:
errormessages.add(ActionMessages.GLOBAL_MESSAGE,
new ActionMessage("loginform.errors.noentry"));
break;
}
saveMessages(request, errormessages);
lf.reset(mapping, request);
userlogin = null;
user = null;
return mapping.findForward("showlogin");
}
}
}
msg2ajay schrieb:
> hello friends,
> I am developing a struts+hibernate application which
> contains a login page. I am not sure of which tools or API's to use for
> logn
> Authentication and encription.
>
> Can any bady suggest me which is best for login Authentication and what way
> can i proceed for secured login for WebApplication.
>
> Ajay
>
Re: what login security&encription are good for struts...?
Posted by Gary Affonso <gl...@greywether.com>.
msg2ajay wrote:
> hello friends,
> I am developing a struts+hibernate application which
> contains a login page. I am not sure of which tools or API's to use for
> logn
> Authentication and encription.
>
> Can any bady suggest me which is best for login Authentication and what way
> can i proceed for secured login for WebApplication.
Acegi, hands down.
We did auth "by hand" for years and just made the switch to Acegi.
Should have done it a long, long time ago. Acegi does require Spring
but that's a huge plus, not a minus.
If you're new to both Spring and Acegi you are facing a significant
learning curve. I can only say: climb the curve, you'll be very happy
you did.
- Gary
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: what login security&encription are good for struts...?
Posted by Ingo Villnow <in...@googlemail.com>.
Hi,
A salt value is a random value that will combinated with a password, so
both can be encrypted encrypt(salt+password) = hash
Please read: http://en.wikipedia.org/wiki/Salt_%28cryptography%29
You don't have to decrypt any passwords.
Yes, 'I am using hibernate to read/write on my database.
Greetings
msg2ajay schrieb:
> hi,
> its a very nice example which u have sent but i have a doubt that
> "as u are using salt(generation) adding to the encripting code that will be
> fine for registeration but what ab the login time how you are going to
> decript the data base code"? and authenticate... and one more thing is are u
> using Hibernate?
>
> once again thanQ
>
>
>
> msg2ajay wrote:
>
>> hello friends,
>> I am developing a struts+hibernate application which
>> contains a login page. I am not sure of which tools or API's to use for
>> logn
>> Authentication and encription.
>>
>> Can any bady suggest me which is best for login Authentication and what
>> way
>> can i proceed for secured login for WebApplication.
>>
>> Ajay
>>
>>
>
>
Re: what login security&encription are good for struts...?
Posted by Piero Sartini <li...@pierosartini.de>.
> its a very nice example which u have sent but i have a doubt that
> "as u are using salt(generation) adding to the encripting code that will be
> fine for registeration but what ab the login time how you are going to
> decript the data base code"?
You do not need to decrypt - you just operate on the encrypted hash. (encode
the given password at login time and match it against the hash in db)
You will have no chance to get the clear text password again.
> and authenticate... and one more thing is are
> u using Hibernate?
Struts2 does not help you when it comes to authorization and authentication.
You have some possibilities: In an enterprise environments you might want to
use the container based security just like in a normal webapp.. there is a
RolesInterceptor for struts that you can use.
Otherwise you have to build a custom security implementation. Or use something
like ACEGI that offers a security framework but depends on spring.
The point is: struts2 does not offer security out of the box.
Piero
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org
Re: what login security&encription are good for struts...?
Posted by msg2ajay <ms...@gmail.com>.
hi,
its a very nice example which u have sent but i have a doubt that
"as u are using salt(generation) adding to the encripting code that will be
fine for registeration but what ab the login time how you are going to
decript the data base code"? and authenticate... and one more thing is are u
using Hibernate?
once again thanQ
msg2ajay wrote:
>
> hello friends,
> I am developing a struts+hibernate application which
> contains a login page. I am not sure of which tools or API's to use for
> logn
> Authentication and encription.
>
> Can any bady suggest me which is best for login Authentication and what
> way
> can i proceed for secured login for WebApplication.
>
> Ajay
>
--
View this message in context: http://www.nabble.com/what-login-security-encription-are-good-for-struts...--tf4795666.html#a13722357
Sent from the Struts - User mailing list archive at Nabble.com.
---------------------------------------------------------------------
To unsubscribe, e-mail: user-unsubscribe@struts.apache.org
For additional commands, e-mail: user-help@struts.apache.org