You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@rave.apache.org by mp...@apache.org on 2011/08/10 00:28:26 UTC
svn commit: r1155575 - in /incubator/rave/trunk/rave-portal/src:
main/java/org/apache/rave/portal/model/
main/java/org/apache/rave/portal/service/
main/java/org/apache/rave/portal/service/impl/ main/webapp/WEB-INF/
main/webapp/WEB-INF/views/ test/java/...
Author: mpierce
Date: Tue Aug 9 22:28:26 2011
New Revision: 1155575
URL: http://svn.apache.org/viewvc?rev=1155575&view=rev
Log:
(RAVE-166) adding hashing and salting based on user name for new user accounts.
Modified:
incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/model/User.java
incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/UserService.java
incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultNewAccountService.java
incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultUserService.java
incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext-security.xml
incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext.xml
incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/views/userProfile.jsp
incubator/rave/trunk/rave-portal/src/test/java/org/apache/rave/portal/repository/JpaUserRepositoryTest.java
Modified: incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/model/User.java
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/model/User.java?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/model/User.java (original)
+++ incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/model/User.java Tue Aug 9 22:28:26 2011
@@ -191,4 +191,5 @@ public class User implements UserDetails
public void setConfirmPassword(String confirmPassword) {
this.confirmPassword=confirmPassword;
}
+
}
Modified: incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/UserService.java
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/UserService.java?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/UserService.java (original)
+++ incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/UserService.java Tue Aug 9 22:28:26 2011
@@ -33,7 +33,7 @@ public interface UserService extends Use
/**
* Set the currently authenticated user to the user with a given userId.
*
- * @param userId the unique id of the user
+ * @param userId the unique id of the use
*/
void setAuthenticatedUser(long userId);
Modified: incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultNewAccountService.java
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultNewAccountService.java?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultNewAccountService.java (original)
+++ incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultNewAccountService.java Tue Aug 9 22:28:26 2011
@@ -27,6 +27,8 @@ import org.apache.rave.portal.service.*;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.security.authentication.encoding.PasswordEncoder;
+import org.springframework.security.authentication.dao.SaltSource;
import org.springframework.stereotype.Service;
import java.util.ArrayList;
@@ -42,9 +44,16 @@ public class DefaultNewAccountService im
private final PageLayoutService pageLayoutService;
private final RegionService regionService;
+
+ @Autowired
+ private SaltSource saltSource;
+
+ @Autowired
+ private PasswordEncoder passwordEncoder;
+
@Autowired
public DefaultNewAccountService(UserService userService, PageService pageService, PageLayoutService pageLayoutService, RegionService regionService) {
- this.userService = userService;
+ this.userService = userService;
this.pageService = pageService;
this.pageLayoutService = pageLayoutService;
this.regionService = regionService;
@@ -54,7 +63,11 @@ public class DefaultNewAccountService im
public void createNewAccount(String userName, String password, String userPageLayout) throws Exception {
User user=new User();
user.setUsername(userName);
- user.setPassword(password);
+ //This assumes we use the username for the salt. If not, the code below will need to change.
+ //See also applicationContext-security.xml
+ String saltedHashedPassword=passwordEncoder.encodePassword(password,saltSource.getSalt(user));
+ logger.debug("Salt Source:"+saltSource.getSalt(user));
+ user.setPassword(saltedHashedPassword);
user.setExpired(false);
user.setLocked(false);
Modified: incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultUserService.java
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultUserService.java?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultUserService.java (original)
+++ incubator/rave/trunk/rave-portal/src/main/java/org/apache/rave/portal/service/impl/DefaultUserService.java Tue Aug 9 22:28:26 2011
@@ -58,6 +58,7 @@ public class DefaultUserService implemen
if(user == null) {
throw new UsernameNotFoundException("User with username '" + username + "' was not found!");
}
+ System.out.println("Can do anything else here too.");
return user;
}
Modified: incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext-security.xml
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext-security.xml?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext-security.xml (original)
+++ incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext-security.xml Tue Aug 9 22:28:26 2011
@@ -57,6 +57,10 @@
<security:authentication-manager>
<security:authentication-provider
- user-service-ref="userService" />
+ user-service-ref="userService">
+ <security:password-encoder ref="passwordEncoder">
+ <security:salt-source ref="saltSource"/>
+ </security:password-encoder>
+ </security:authentication-provider>
</security:authentication-manager>
</beans>
Modified: incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext.xml
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext.xml?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext.xml (original)
+++ incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/applicationContext.xml Tue Aug 9 22:28:26 2011
@@ -111,4 +111,10 @@
<!-- Configuring messages.properties file -->
<bean id="messageSource" class="org.springframework.context.support.ResourceBundleMessageSource" p:basename="messages" />
+ <!-- Password encoding and salting-->
+ <bean class="org.springframework.security.authentication.encoding.ShaPasswordEncoder" id="passwordEncoder"/>
+ <bean class="org.springframework.security.authentication.dao.ReflectionSaltSource" id="saltSource">
+ <property name="userPropertyToUse" value="username"/>
+ </bean>
+
</beans>
\ No newline at end of file
Modified: incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/views/userProfile.jsp
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/views/userProfile.jsp?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/views/userProfile.jsp (original)
+++ incubator/rave/trunk/rave-portal/src/main/webapp/WEB-INF/views/userProfile.jsp Tue Aug 9 22:28:26 2011
@@ -38,7 +38,7 @@
</p>
<p>
<label for="passwordConfirmField">Confirm Password:</label>
- <form:input id="passwordConfirmField" type="password" path="confirmPassword" required="required"/>
+ <input id="passwordConfirmField" type="password" path="confirmPassword" required="required"/>
<form:errors path="confirmPassword" cssClass="error" />
</p>
<p>
Modified: incubator/rave/trunk/rave-portal/src/test/java/org/apache/rave/portal/repository/JpaUserRepositoryTest.java
URL: http://svn.apache.org/viewvc/incubator/rave/trunk/rave-portal/src/test/java/org/apache/rave/portal/repository/JpaUserRepositoryTest.java?rev=1155575&r1=1155574&r2=1155575&view=diff
==============================================================================
--- incubator/rave/trunk/rave-portal/src/test/java/org/apache/rave/portal/repository/JpaUserRepositoryTest.java (original)
+++ incubator/rave/trunk/rave-portal/src/test/java/org/apache/rave/portal/repository/JpaUserRepositoryTest.java Tue Aug 9 22:28:26 2011
@@ -44,6 +44,9 @@ public class JpaUserRepositoryTest {
private static final Long USER_ID = 1L;
private static final String USER_NAME = "canonical";
+ //The password value depends on the hash algorithm and salt used, so this
+ //may need updating in the future.
+ private static final String HASHED_SALTED_PASSWORD="b97fd0fa25ba8a504309be2b6651ac6dee167ded";
private static final Long INVALID_USER = -2L;
@Autowired
@@ -54,7 +57,7 @@ public class JpaUserRepositoryTest {
User user = repository.get(USER_ID);
assertThat(user, CoreMatchers.notNullValue());
assertThat(user.getUsername(), is(equalTo(USER_NAME)));
- assertThat(user.getPassword(), is(equalTo(USER_NAME)));
+ assertThat(user.getPassword(), is(equalTo(HASHED_SALTED_PASSWORD)));
assertThat(user.isAccountNonExpired(), is(true));
}
@Test
@@ -67,7 +70,7 @@ public class JpaUserRepositoryTest {
User user = repository.getByUsername(USER_NAME);
assertThat(user, CoreMatchers.notNullValue());
assertThat(user.getId(), is(equalTo(USER_ID)));
- assertThat(user.getPassword(), is(equalTo(USER_NAME)));
+ assertThat(user.getPassword(), is(equalTo(HASHED_SALTED_PASSWORD)));
assertThat(user.isAccountNonExpired(), is(true));
}
@Test