You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@karaf.apache.org by ff...@apache.org on 2019/07/17 15:06:48 UTC
[karaf] branch karaf-4.2.x updated: KARAF-6359 - Clients can log in
with encrypted passwords
This is an automated email from the ASF dual-hosted git repository.
ffang pushed a commit to branch karaf-4.2.x
in repository https://gitbox.apache.org/repos/asf/karaf.git
The following commit(s) were added to refs/heads/karaf-4.2.x by this push:
new 9e2e127 KARAF-6359 - Clients can log in with encrypted passwords
9e2e127 is described below
commit 9e2e1271b1ecbfa92af6fb240f52d79975f6fab9
Author: Colm O hEigeartaigh <co...@apache.org>
AuthorDate: Wed Jul 17 13:07:36 2019 +0100
KARAF-6359 - Clients can log in with encrypted passwords
(cherry picked from commit 7434001dece25e467c61b68c191fb26a2f76b9b4)
---
.../features/standard/src/main/feature/feature.xml | 2 +-
.../resources/etc/org.apache.karaf.jaas.cfg | 4 ++--
.../src/test/filtered-resources/etc/feature.xml | 2 +-
.../jaas/modules/AbstractKarafLoginModule.java | 17 +++++----------
.../jaas/modules/encryption/EncryptionSupport.java | 24 +++++++++++++++-------
manual/src/main/asciidoc/user-guide/security.adoc | 2 +-
6 files changed, 27 insertions(+), 24 deletions(-)
diff --git a/assemblies/features/standard/src/main/feature/feature.xml b/assemblies/features/standard/src/main/feature/feature.xml
index 8961dba..8bb69fa 100644
--- a/assemblies/features/standard/src/main/feature/feature.xml
+++ b/assemblies/features/standard/src/main/feature/feature.xml
@@ -662,7 +662,7 @@ encryption.enabled = false
# a more powerful one named 'jasypt' is available
# when installing the encryption feature
#
-encryption.name =
+encryption.name = basic
#
# Encryption prefix
diff --git a/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.jaas.cfg b/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.jaas.cfg
index 8ac5af6..ace5fe4 100644
--- a/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.jaas.cfg
+++ b/instance/src/main/resources/org/apache/karaf/instance/resources/etc/org.apache.karaf.jaas.cfg
@@ -28,7 +28,7 @@ encryption.enabled = false
# a more powerful one named 'jasypt' is available
# when installing the encryption feature
#
-encryption.name =
+encryption.name = basic
#
# Encryption prefix
@@ -58,4 +58,4 @@ encryption.algorithm = MD5
# hexadecimal
# base64
#
-encryption.encoding = hexadecimal
\ No newline at end of file
+encryption.encoding = hexadecimal
diff --git a/itests/test/src/test/filtered-resources/etc/feature.xml b/itests/test/src/test/filtered-resources/etc/feature.xml
index 9b19158..3197680 100644
--- a/itests/test/src/test/filtered-resources/etc/feature.xml
+++ b/itests/test/src/test/filtered-resources/etc/feature.xml
@@ -450,7 +450,7 @@
# a more powerful one named 'jasypt' is available
# when installing the encryption feature
#
- encryption.name =
+ encryption.name = basic
#
# Encryption prefix
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
index 0a07c47..6865580 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/AbstractKarafLoginModule.java
@@ -2,9 +2,9 @@
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
- *
+ *
* http://www.apache.org/licenses/LICENSE-2.0
- *
+ *
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
@@ -43,7 +43,7 @@ public abstract class AbstractKarafLoginModule implements LoginModule {
protected CallbackHandler callbackHandler;
protected boolean debug;
protected Map<String, ?> options;
-
+
protected String rolePolicy;
protected String roleDiscriminator;
protected boolean detailedLoginExcepion;
@@ -127,15 +127,8 @@ public abstract class AbstractKarafLoginModule implements LoginModule {
encryptionSupport = new EncryptionSupport(options);
}
- public boolean checkPassword(String plain, String encrypted) {
- String newEncrypted = encryptionSupport.encrypt(plain);
- String prefix = encryptionSupport.getEncryptionPrefix();
- String suffix = encryptionSupport.getEncryptionSuffix();
- boolean isMatch = encryptionSupport.getEncryption() != null
- ? encryptionSupport.getEncryption().checkPassword(plain,
- encrypted.substring(prefix.length(), encrypted.length() - suffix.length())) : false;
- return encrypted.equals(newEncrypted)
- || isMatch;
+ public boolean checkPassword(String password, String storedPassword) {
+ return encryptionSupport.checkPassword(password, storedPassword);
}
}
diff --git a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
index 49a3154..31080df 100644
--- a/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
+++ b/jaas/modules/src/main/java/org/apache/karaf/jaas/modules/encryption/EncryptionSupport.java
@@ -40,7 +40,7 @@ public class EncryptionSupport {
private String name;
private Map<String, String> encOpts;
-
+
public static EncryptionSupport noEncryptionSupport() {
Map<String, Object> options = new HashMap<>();
options.put("enabled", "false");
@@ -68,7 +68,7 @@ public class EncryptionSupport {
logOptions();
}
}
-
+
public String encrypt(String plain) {
getEncryption();
if (encryption == null || isEncrypted(plain)) {
@@ -77,7 +77,17 @@ public class EncryptionSupport {
return encryptionPrefix + encryption.encryptPassword(plain) + encryptionSuffix;
}
}
-
+
+ public boolean checkPassword(String provided, String real) {
+ getEncryption();
+ if (encryption == null) {
+ return provided != null && provided.equals(real);
+ } else {
+ String encryptedPassword = real.substring(encryptionPrefix.length(), real.length() - encryptionSuffix.length());
+ return encryption.checkPassword(provided, encryptedPassword);
+ }
+ }
+
private void logOptions() {
if (name != null && name.length() > 0) {
logger.debug("Encryption is enabled. Using service " + name + " with options " + encOpts);
@@ -85,11 +95,11 @@ public class EncryptionSupport {
logger.debug("Encryption is enabled. Using options " + encOpts);
}
}
-
+
private String defaulIfNull(String value, String defaultValue) {
return value == null ? defaultValue : value;
}
-
+
private boolean isEncrypted(String password) {
boolean prefixPresent = "".equals(encryptionPrefix) || password.startsWith(encryptionPrefix);
boolean suffixPresent = "".equals(encryptionSuffix) || password.endsWith(encryptionSuffix);
@@ -150,7 +160,7 @@ public class EncryptionSupport {
private org.osgi.framework.Filter getFilter() {
String nameFilter = name != null && name.length() > 0 ? "(name=" + name + ")" : null;
String objFilter = "(objectClass=" + EncryptionService.class.getName() + ")";
- String filter = nameFilter == null ? objFilter : "(&" + nameFilter + objFilter + ")";
+ String filter = nameFilter == null ? objFilter : "(&" + nameFilter + objFilter + ")";
try {
return FrameworkUtil.createFilter(filter);
} catch (InvalidSyntaxException e) {
@@ -177,7 +187,7 @@ public class EncryptionSupport {
public void setEncryptionPrefix(String encryptionPrefix) {
this.encryptionPrefix = encryptionPrefix;
}
-
+
/**
* For tests
*/
diff --git a/manual/src/main/asciidoc/user-guide/security.adoc b/manual/src/main/asciidoc/user-guide/security.adoc
index 0c45983..4533df8 100644
--- a/manual/src/main/asciidoc/user-guide/security.adoc
+++ b/manual/src/main/asciidoc/user-guide/security.adoc
@@ -298,7 +298,7 @@ encryption.enabled = false
# a more powerful one named 'jasypt' is available
# when installing the encryption feature
#
-encryption.name =
+encryption.name = basic
#
# Encryption prefix