Do multiple clients of the same Shiro Application use the same shiro.ini file?

[KonradZuse <Th...@hotmail.com>]

Hello all,

I am now creating a desktop client for a portion of my application, where
the other part is a web application.  

I am using the same DB to login, as well as store information.

I am confused if I am supposed to  use the same ini file or use multiple.  I
am curious about the hasher/passwordmatching algorithm and if we need the
same one?

I figured every time it's generated it's random, but I guess the same specs
should give the same results, or else it would never work regardless?

If anyone has any insight I would appreciate it greatly!

Thank you!!



--
View this message in context: http://shiro-user.582556.n2.nabble.com/Do-multiple-clients-of-the-same-Shiro-Application-use-the-same-shiro-ini-file-tp7580208.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Do multiple clients of the same Shiro Application use the same shiro.ini file?

[KonradZuse <Th...@hotmail.com>]

I am looking to, yes, but didn't realize that it does in fact do it itself,
but now I see it with "setHashService" in the docs.

Thanks for the info, it does make soem sense, I also found out a lot of info
here.

https://crackstation.net/hashing-security.htm

So to ask my question again, do I need to use the same ini file or no?  I'm
not sure if I need the same information for both.

here is my ini file.

[main]

authc.loginUrl = /login.jsp
authc.successUrl = /viewer.jsp

 # password matcher
 #passwordMatcher = org.apache.shiro.authc.credential.PasswordMatcher
 #passwordService = org.apache.shiro.authc.credential.DefaultPasswordService
 #passwordMatcher.passwordService = $passwordService
 
#ds = com.mysql.jdbc.jdbc2.optional.MysqlConnectionPoolDataSource
#ds.serverName = ********
#ds.port  = 3306 
#ds.databaseName = ********
#ds.user = *******
#ds.password = *****
 
 #jdbcRealm = org.apache.shiro.realm.jdbc.JdbcRealm
 #jdbcRealm.permissionsLookupEnabled = true
 #jdbcRealm.authenticationQuery = SELECT password FROM **** WHERE username =
?
 #jdbcRealm.userRolesQuery = SELECT roles FROM ***** WHERE username = ?
 #jdbcRealm.permissionsQuery = SELECT ***** FROM Company WHERE role_name = ?
 #jdbcRealm.credentialsMatcher = $passwordMatcher
 #jdbcRealm.dataSource=$ds

 #securityManager.realms = $jdbcRealm
 
cacheManager = org.apache.shiro.cache.MemoryConstrainedCacheManager
securityManager.cacheManager = $cacheManager

sessionManager = org.apache.shiro.web.session.mgt.DefaultWebSessionManager
sessionDAO = org.apache.shiro.session.mgt.eis.EnterpriseCacheSessionDAO

securityManager.sessionManager = $sessionManager
securityManager.sessionManager.sessionDAO = $sessionDAO

I am looking to switch over to the EHCache as I hear it's better for web as
the regular breaks sessions apparentyly.


I'm not too sure if I need all of this or what exactly I need, but I have
been forming bits and pieces of stuff I have seen.

I don't think I need all of this, and somethings will change.

Thanks for the help.




--
View this message in context: http://shiro-user.582556.n2.nabble.com/Do-multiple-clients-of-the-same-Shiro-Application-use-the-same-shiro-ini-file-tp7580208p7580210.html
Sent from the Shiro User mailing list archive at Nabble.com.

Re: Do multiple clients of the same Shiro Application use the same shiro.ini file?

[Alexander Openkowski <op...@googlemail.com>]

Do you use Shiro's DefaultPasswordService
<https://shiro.apache.org/static/current/apidocs/org/apache/shiro/authc/credential/DefaultPasswordService.html>
to generate the encrypted passwords you store in the DB and also to check
if the user has entered a valid password?

Because if so, you do not need to worry about the algorithms. Afaik the
DefaultPasswordService adds information to the encrypted passwords it
generates to later know how to match it with plain text passwords:


$shiro1$SHA-256$500000$iJRddPc2jpRrerxLRXskmQ==$U88i9zJCUZOKJ++1J3tqW5qTa2xUnCho5AaTHyevmsE=

In the default settings it seems to use SHA-256 with 500000 iterations +
some salt that is generated for each password to encrypt a password. I
think the "iJRddPc2jpRrerxLRXskmQ==" part is the salt here?

When you now give the DefaultPasswordService such an encrypted password
string, it knows how to match it with a plain text password. Because of
that, it is even possible to switch the used algorithm etc. in your
application over the time without having to reset all passwords.

Does that help you?

That is just my understanding of how things work, please correct me if I'm
wrong with something! ; )

On Fri, Sep 12, 2014 at 7:42 AM, KonradZuse <Th...@hotmail.com>
wrote:

> Hello all,
>
> I am now creating a desktop client for a portion of my application, where
> the other part is a web application.
>
> I am using the same DB to login, as well as store information.
>
> I am confused if I am supposed to  use the same ini file or use multiple.
> I
> am curious about the hasher/passwordmatching algorithm and if we need the
> same one?
>
> I figured every time it's generated it's random, but I guess the same specs
> should give the same results, or else it would never work regardless?
>
> If anyone has any insight I would appreciate it greatly!
>
> Thank you!!
>
>
>
> --
> View this message in context:
> http://shiro-user.582556.n2.nabble.com/Do-multiple-clients-of-the-same-Shiro-Application-use-the-same-shiro-ini-file-tp7580208.html
> Sent from the Shiro User mailing list archive at Nabble.com.
>