You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@shiro.apache.org by "bmarwell (via GitHub)" <gi...@apache.org> on 2023/07/23 19:17:34 UTC
[GitHub] [shiro-site] bmarwell opened a new pull request, #186: [#185] update documentation on shiro2
bmarwell opened a new pull request, #186:
URL: https://github.com/apache/shiro-site/pull/186
Looking at this, does the ini parser even work now? We need to investigate before we can release Shiro 2.
Especially:
```
user1 = $shiro2$argon2id$v=19$t=1,m=65536,p=4$H5z81Jpr4ntZr3MVtbOUBw$fJDgZCLZjMC6A2HhnSpxULMmvVdW3su+/GCU3YbxfFQ, role1, role2, ...
```
I cannot recall if we tested this properly (commas...).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on code in PR #186:
URL: https://github.com/apache/shiro-site/pull/186#discussion_r1463873244
##########
src/site/content/configuration.adoc:
##########
@@ -439,40 +439,33 @@ Each line in the [users] section must conform to the following format:
[#Configuration-INIConfiguration-Sections-users-EncryptingPasswords]
===== Encrypting Passwords
-If you don't want the [users] section passwords to be in plain-text, you can encrypt them using your favorite hash algorithm (MD5, Sha1, Sha256, etc.) however you like and use the resulting string as the password value. By default, the password string is expected to be Hex encoded, but can be configured to be Base64 encoded instead (see below).
+Since Shiro 2.0, the `[users]` section cannot contain plain-text passwords.
+You can encrypt them using https://en.wikipedia.org/wiki/Key_derivation_function[key derivation functions].
+Shiro provides implementations for bcrypt and argon2.
+If unsure, use argon2 derived passwords.
+
+The algorithms from Shiro 1 (e.g. md5, SHA1, SHA256, etc.) are long deemed insecure and not supported anymore.
+There is neither a direct migration path nor backward compatibility.
Review Comment:
This is technically not true since Shiro 2 can encrypt / decrypt Shiro 1.x passwords. There is forward-and-backward path for compatibility as I tested this recently. This is a good thing IMHO.
Currently, it takes some "finagling" to get working which I think is a good thing, it makes compatibility possibly but use Argon2 by default.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on code in PR #186:
URL: https://github.com/apache/shiro-site/pull/186#discussion_r1463870353
##########
src/site/content/configuration.adoc:
##########
@@ -439,40 +439,33 @@ Each line in the [users] section must conform to the following format:
[#Configuration-INIConfiguration-Sections-users-EncryptingPasswords]
===== Encrypting Passwords
-If you don't want the [users] section passwords to be in plain-text, you can encrypt them using your favorite hash algorithm (MD5, Sha1, Sha256, etc.) however you like and use the resulting string as the password value. By default, the password string is expected to be Hex encoded, but can be configured to be Base64 encoded instead (see below).
+Since Shiro 2.0, the `[users]` section cannot contain plain-text passwords.
Review Comment:
Is this actually true? I seem to remember this plain-text passwords work in shiro 2 at the moment
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1863825212
I published this PR at https://shiro.staged.apache.org
Take a peek :) I think lots of work still needs to be done.
Sha256 classes are deprecated but are referenced everywhere, for example.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak merged PR #186:
URL: https://github.com/apache/shiro-site/pull/186
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1868229316
I have tested the `ini` configuration, and this works (and should be documented):
```
user1 = "$shiro2$argon2id$v=19$t=1,m=65536,p=4$H5z81Jpr4ntZr3MVtbOUBw$fJDgZCLZjMC6A2HhnSpxULMmvVdW3su+/GCU3YbxfFQ", role1, role2, ...
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "lprimak (via GitHub)" <gi...@apache.org>.
lprimak commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1868229775
Sorry about my earlier comments about SHA256 being deprecated. I confused `SHA256CredentialMatcher` with `SHA256Hash` which is not deprecated.
Carry on!
Honestly I think we are close to beta now!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "fpapon (via GitHub)" <gi...@apache.org>.
fpapon commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1806899342
> -1 Francois, we wanted to use a separate path in the URL.
I'm not sure to follow the separate path thing, can you explain?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "bmarwell (via GitHub)" <gi...@apache.org>.
bmarwell commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1806830473
-1 Francois, we wanted to use a separate path in the URL.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [#185] update documentation on shiro2 [shiro-site]
Posted by "bmarwell (via GitHub)" <gi...@apache.org>.
bmarwell commented on PR #186:
URL: https://github.com/apache/shiro-site/pull/186#issuecomment-1905642657
So, updated the structure but have not yet copied everything over. We can do it now or later, two new macros should help with this.
Later fixes:
* copy over other files
* Add "shiro-hasv2: true" tags where appropriate
* fix the admonition icons
* Fix the menu to contain more links, eg. the command-line-hasher file itself.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: dev-unsubscribe@shiro.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org