You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@ofbiz.apache.org by Carsten Schinzer <ca...@dcs-verkaufssysteme.de> on 2026/10/08 05:21:51 UTC
[DISCUSSION] Adding Bcrypt Password Support to OFBiz
Hello all,
I'm working on integrating OFBiz with an external system that uses bcrypt for password hashing ($2a$ format).
Since OFBiz is not our source of truth for user credentials, I'd like to:
1. Store bcrypt hashes directly in user_login.current_password
2. Extend OFBiz's authentication to verify bcrypt hashes alongside PBKDF2/SHA256
I've implemented a custom authenticator using org.mindrot:jbcrypt that:
- Checks bcrypt hashes first (for external users)
- Falls back to HashCrypt for internal users
Would the community be interested in:
- A patch to add native bcrypt support to HashCrypt?
- Documentation on extending authentication for external password schemes?
- A new JIRA issue to track this feature?
Current OFBiz supports:
- SHA-1 (legacy)
- MD5 (legacy)
- PBKDF2 (SHA256, SHA384, SHA512) [OFBIZ-8537]
Adding bcrypt would align OFBiz with modern security best practices and improve interoperability with systems like WordPress, Django, etc.
Any thoughts?
Warm regards
Carsten
Re: [DISCUSSION] Adding Bcrypt Password Support to OFBiz
Posted by Carsten Schinzer <ca...@dcs-verkaufssysteme.de>.
Its a while I shared the idea, but not forgotten.
I am working on this during the current week.
Opening an OFBiz ticket then.
Warm regards
Carsten
---
Dr. Carsten Schinzer
Am Do., 8. Okt. 2026 um 13:50 Uhr schrieb nicolas.malin.nereide.fr via dev <
dev@ofbiz.apache.org>:
> Hello Carsten,
>
> Yes sure share it ! :)
>
> Personally I'm not focus on this part but can take time to have a look
> and suggest some thinking from my side.
>
> Nicolas
>
> Le 08/10/2026 à 07:21, Carsten Schinzer a écrit :
> > Hello all,
> >
> >
> > I'm working on integrating OFBiz with an external system that uses
> bcrypt for password hashing ($2a$ format).
> >
> > Since OFBiz is not our source of truth for user credentials, I'd like to:
> >
> > 1. Store bcrypt hashes directly in user_login.current_password
> > 2. Extend OFBiz's authentication to verify bcrypt hashes alongside
> PBKDF2/SHA256
> >
> > I've implemented a custom authenticator using org.mindrot:jbcrypt that:
> > - Checks bcrypt hashes first (for external users)
> > - Falls back to HashCrypt for internal users
> >
> > Would the community be interested in:
> > - A patch to add native bcrypt support to HashCrypt?
> > - Documentation on extending authentication for external password
> schemes?
> > - A new JIRA issue to track this feature?
> >
> > Current OFBiz supports:
> > - SHA-1 (legacy)
> > - MD5 (legacy)
> > - PBKDF2 (SHA256, SHA384, SHA512) [OFBIZ-8537]
> >
> > Adding bcrypt would align OFBiz with modern security best practices and
> improve interoperability with systems like WordPress, Django, etc.
> >
> > Any thoughts?
> >
> > Warm regards
> >
> >
> > Carsten
> >
> >
>
Re: [DISCUSSION] Adding Bcrypt Password Support to OFBiz
Posted by "nicolas.malin.nereide.fr via dev" <de...@ofbiz.apache.org>.
Hello Carsten,
Yes sure share it ! :)
Personally I'm not focus on this part but can take time to have a look
and suggest some thinking from my side.
Nicolas
Le 08/10/2026 à 07:21, Carsten Schinzer a écrit :
> Hello all,
>
>
> I'm working on integrating OFBiz with an external system that uses bcrypt for password hashing ($2a$ format).
>
> Since OFBiz is not our source of truth for user credentials, I'd like to:
>
> 1. Store bcrypt hashes directly in user_login.current_password
> 2. Extend OFBiz's authentication to verify bcrypt hashes alongside PBKDF2/SHA256
>
> I've implemented a custom authenticator using org.mindrot:jbcrypt that:
> - Checks bcrypt hashes first (for external users)
> - Falls back to HashCrypt for internal users
>
> Would the community be interested in:
> - A patch to add native bcrypt support to HashCrypt?
> - Documentation on extending authentication for external password schemes?
> - A new JIRA issue to track this feature?
>
> Current OFBiz supports:
> - SHA-1 (legacy)
> - MD5 (legacy)
> - PBKDF2 (SHA256, SHA384, SHA512) [OFBIZ-8537]
>
> Adding bcrypt would align OFBiz with modern security best practices and improve interoperability with systems like WordPress, Django, etc.
>
> Any thoughts?
>
> Warm regards
>
>
> Carsten
>
>