Salting password

[suryazi <su...@abg.com.sa>]

Hi,

   I am using the Shiro plugin (Shiro 1.1.4) in my Grails application. I am
using the below code to save the user in my bootstrap

           def user = new User(username: "User", passwordHash: new
Sha512Hash("password").toHex())
           user.save()

I am able to login into the system using the above credentials.

My problem is after salting the password as below

           def user = new User(username: "User", passwordHash: *new
Sha512Hash("password","User",1024)*.toHex())
           user.save()

I am unable to logon and the system is showing invalid username/password
message. Please let me know how to overcome it.



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Salting-password-tp7577622.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Salting password

[suryazi <su...@abg.com.sa>]

Yes I already fixed the problem. Anyhow thank you for your help and suggested
code. I would like to know whether is it possible to use the Bcrypt hashing
algorithm instead of SHA-512.


alarinn wrote
> 
> Have you made the necessary changes to the realm?
> 
> For example, here's my setup:
> 
> *	<bean id="sha512Matcher"
> class="org.apache.shiro.authc.credential.HashedCredentialsMatcher">
> 		
> 		<property name="hashAlgorithmName" value="SHA-256" />
> 		<property name="hashIterations" value="1024" />
> 	</bean>*
> 	
> 	
> 	
> 	<bean id="opacsRealm" class="org.apache.shiro.realm.jdbc.JdbcRealm">
> 		<property name="dataSource" ref="dataSource" />
> 		<property name="authenticationQuery"
> 			value="select PASSWORD, SALT from SEC_USERS where NAME = ?" />
> 		<property name="userRolesQuery"
> 			value="SELECT ROLE_NAME FROM SEC_USERS_ROLES WHERE USER_NAME = ?" />
> 		<property name="permissionsQuery"
> 			value="SELECT permission FROM SEC_ROLES_PERMISSIONS WHERE ROLE_NAME =
> ?" />
> 		<property name="permissionsLookupEnabled" value="true" />
> *		<property name="saltStyle" value="COLUMN" />
> 		<property name="credentialsMatcher" ref="sha512Matcher"/>*
> 	</bean>
> 
> You may or may not need the saltStyle property but you do need the
> hashAlgorithmName and hashIterations defined in your
> HashedCredentialsMatcher bean definition.
> 




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Salting-password-tp7577622p7577697.html
Sent from the Shiro User mailing list archive at Nabble.com.