What is the recommended approach to implement password reset with Shiro ?

[I PVP <ip...@hotmail.com>]

What is the recommended approach to implement password reset functionality with Shiro ?

Should I just  generate a new password,  update the  database, send to the end user over email  and force the user to change on the next login? Or Is there something more elegant that should be done using Shiro ?


Thanks

IPVP

Re: What is the recommended approach to implement password reset with Shiro ?

[Brian Demers <br...@gmail.com>]

Shiro does not provide any database write logic out of the box, there are a
lot of things at play here, mail server config, db update command, password
reset GUI, etc.

Take a look at this:
https://github.com/apache/shiro/blob/1.3.x/core/src/main/java/org/apache/shiro/realm/SimpleAccountRealm.java#L162-L164
(this is not a complete example, as you would still need to handle
the ExpiredCredentialsException)

There was also a related thread a few days ago:
http://shiro-user.582556.n2.nabble.com/Shiro-and-OTP-MFA-tc7581190.html



On Tue, Aug 2, 2016 at 9:25 AM, I PVP <ip...@hotmail.com> wrote:

> What is the recommended approach to implement password reset functionality
> with Shiro ?
>
> Should I just  generate a new password,  update the  database, send to the
> end user over email  and force the user to change on the next login? Or Is
> there something more elegant that should be done using Shiro ?
>
>
> Thanks
>
> IPVP
>
>

RE: What is the recommended approach to implement password reset with Shiro ?

[Richard Wheeldon <ri...@voxsmart.com>]

Not quite: “To limit denial-of-service attacks the application should email a link to the user with a random token, and only if the user visits the link then the reset procedure is completed. This ensures that the current password will still be valid until the reset has been confirmed.”
https://www.owasp.org/index.php/Testing_for_weak_password_change_or_reset_functionalities_(OTG-AUTHN-009)

I asked a similar question the other day and was pointed to SonaType’s Nexus and to StormPath but it seems like a common ask that Shiro could potentially be more helpful with,

Regards,

Richard

From: I PVP [mailto:ipvp@hotmail.com]
Sent: Tuesday, August 2, 2016 2:25 PM
To: user@shiro.apache.org
Subject: What is the recommended approach to implement password reset with Shiro ?

What is the recommended approach to implement password reset functionality with Shiro ?

Should I just  generate a new password,  update the  database, send to the end user over email  and force the user to change on the next login? Or Is there something more elegant that should be done using Shiro ?


Thanks

IPVP

Re: What is the recommended approach to implement password reset with Shiro ?

[Andreas Reichel <an...@manticore-projects.com>]

I would like to ask this question more generic: In a mixed realm environment, e.g. AD 1, �AD 2 and JDBC:

1) how to identify, which realm was responsible for the authorization attempt or failure
2) how to change Passwords as per realm type?


Thanks and cheers
Andreas


On Tue, 2016-08-02 at 13:25 +0000, I PVP wrote:
> 
> 
> What is the recommended approach to implement password reset functionality with Shiro ?
> 
> 
> 
> 
> 
> 
> > Should I just �generate a new password, �update the �database, send to the end user over email �and force the user to
change on the next login? Or Is there something more elegant that should be done
> �using Shiro ?
> 
> 
> 
> 
> 
> 
> 
> 
> 
> Thanks
> 
> 
> 
> 
> 
> IPVP
> 
> 
> 
> 
> 
> 
> 
> 
>