[jira] [Commented] (ISIS-2884) Passwords not matching after restart

["Andi Huber (Jira)" <ji...@apache.org>]

    [ https://issues.apache.org/jira/browse/ISIS-2884?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17449165#comment-17449165 ] 

Andi Huber commented on ISIS-2884:
----------------------------------

If I understand correctly, the core issue is not the salt that's getting recreated for each JVM instance, but rather that we are using the matching test wrong with code like
appUser.getEncryptedPassword().equals(encryptedPassword)

> Passwords not matching after restart
> ------------------------------------
>
>                 Key: ISIS-2884
>                 URL: https://issues.apache.org/jira/browse/ISIS-2884
>             Project: Isis
>          Issue Type: Bug
>            Reporter: Daniel Keir Haywood
>            Assignee: Andi Huber
>            Priority: Major
>             Fix For: 2.0.0-M7
>
>
> When I restart the web app the old passwords don’t work.
>  
> I think this might be the cause of that:
>  
> @Service
> @Named("isis.ext.secman.PasswordEncryptionServiceUsingJBcrypt")
> @javax.annotation.Priority(PriorityPrecedence.MIDPOINT)
> @Qualifier("JBCrypt")
> public class PasswordEncryptionServiceUsingJBcrypt implements PasswordEncryptionService {
> private String salt;
> private String getSalt() {
> if (salt == null) {
> salt = BCrypt.gensalt();
> }
> return salt;
> }
> @Override
> public String encrypt(String password) {
> return password == null ? null : BCrypt.hashpw(password, getSalt());
> }
> That looks like the salt is set on the service and would be different after the service is used following an app restart.
>  
> One solution might be a variant that picks up the salt from a property file.



--
This message was sent by Atlassian Jira
(v8.20.1#820001)