Spring Security:password encoding in DB and in applicationContext

Question

Have config (applicationContext-security.xml):

<authentication-manager alias="authenticationManager">
    <authentication-provider>
    <password-encoder hash="sha"/>
        <jdbc-user-service data-source-ref="dataSource"/>
    </authentication-provider>
</authentication-manager>

from other side have SQLs from my dataSource(it's JdbcDaoImpl):

...
    public static final String DEF_USERS_BY_USERNAME_QUERY =
            "select username,password,enabled " +
            "from users " +
            "where username = ?";
...

There is now word about sha in this code,so password selected from standard Spring Security users table not encoded.

Perhaps, I should provide some sha attribute for password column in my hibernate mapping config here:

<class name="model.UserDetails" table="users">
    <id name="id">
        <generator class="increment"/>
    </id>
    <property name="username" column="username"/>
    <property name="password" column="password"/>
    <property name="enabled" column="enabled"/>
    <property name="mail" column="mail"/>
    <property name="city" column="city"/>
    <property name="confirmed" column="confirmed"/>
    <property name="confirmationCode" column="confirmation_code"/>

    <set name="authorities" cascade="all" inverse="true">
        <key column="id" not-null="true"/>
        <one-to-many class="model.Authority"/>
    </set>

</class>

For now password saved to DB as is,but should be encoded.

How to friend applicationContext config and DB queries to be the same password encoding?

Lorenzo Polidori · Accepted Answer · 2016-12-21 15:20:26Z

81

If you are choosing a hashing system yourself, rather than building an app using an existing database which already contains hashed passwords, then you should make sure your hashing algorithm also uses a salt. Don't just use a plain digest.

A good choice is bcrypt, which we now support directly in Spring Security 3.1 via the BCryptPasswordEncoder (implemented using jBCrypt). This automatically generates a salt and concatenates it with the hash value in a single String.

Some databases have built-in support for hashing (e.g. Postgres). Otherwise, you need to hash the password yourself before passing it to JDBC:

String password = "plaintextPassword";
PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String hashedPassword = passwordEncoder.encode(password);

That's all you need to do to encode the passwords when you create a user.

For authentication, you would use something like:

<bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

<bean id="authProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
  <property name="userDetailsService" ref="yourJdbcUserService" />
  <property name="passwordEncoder" ref="encoder" />
</bean>

edited Dec 21, 2016 at 15:20

Lorenzo Polidori

10.6k10 gold badges55 silver badges61 bronze badges

answered Dec 16, 2011 at 1:26

Shaun the Sheep

22.9k2 gold badges76 silver badges103 bronze badges

Sign up to request clarification or add additional context in comments.

9 Comments

sergionni Over a year ago

about salt,I know, it's the next phase of my security challenge))

Shaun the Sheep Over a year ago

If you use something like bcrypt, then it is automatically handled for you, so there isn't really any challenge :-). You don't have to handle the salt yourself.

falsarella Over a year ago

@LukeTaylor Could you show how it would be configured in the applicationContext-security.xml?

Adelin Over a year ago

I am wondering how BCryptPasswordEncoder works. Does it generate one salt for all passwords or a separate salt for each ? If so where does it store the user-salt ?

Shaun the Sheep Over a year ago

BCrypt isn't an encryption algorithm and the salt is stored in the same string. Perhaps the Wikipedia article on Bcrypt will help.

|

Venugopal Madathil · Accepted Answer · 2016-06-10 18:48:06Z

12

A little more explanation on the accepted answer. Hope it helps someone.

Hash the password yourself before putting it to database:

String password = "plaintextPassword";
PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
String hashedPassword = passwordEncoder.encode(password);

Add BCryptPasswordEncoder bean to your security-config.xml

Add passwordEncoder as a property to Authentication Provider class. Autowire it or provide setter and getter methods.

@AutoWired
private BCryptPasswordEncoder passwordEncoder;

Get the property while you authendicate user for login

<bean id="dbAuthenticationProvider" class="mypackage.auth.spring.DBAuthenticationProvider" >
    <property name="dataSource" ref="routingDataSource"></property>
    <property name="passwordEncoder" ref="encoder" />
    <property name="passwordQuery"
        value="select password as password from tbl where username=:username">
    </property> 
</bean>

And in the authenticating class match both passwords

 new BCryptPasswordEncoder().matches(plainTextPasswdFromUserInput, hashedPasswdFromDb)

edited Jun 10, 2016 at 18:48

answered Feb 5, 2013 at 8:58

Venugopal Madathil

2,0213 gold badges34 silver badges43 bronze badges

1 Comment

Yogesh Sanchihar Over a year ago

matches method was what I was looking.

Sully · Accepted Answer · 2014-07-06 17:13:47Z

In a simple way can you do something like in applicationContext-security.xml

<authentication-manager alias="authenticationManager">
   <authentication-provider>
    <password-encoder ref="encoder"/>
    <jdbc-user-service data-source-ref="dataSource"
       users-by-username-query="
          select username,password, enabled 
          from principal where username=?" 
       authorities-by-username-query="
          select p.username, a.authority from principal p, authority a
          where p.id = a.principal_id and p.username=?" 
    />
   </authentication-provider>
</authentication-manager> 

  <beans:bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

In Java

public static String encodePasswordWithBCrypt(String plainPassword){
    return new BCryptPasswordEncoder().encode(plainPassword);
}

Then test it

System.out.println(encodePasswordWithBCrypt("fsdfd"));

falsarella · Accepted Answer · 2014-08-15 23:06:08Z

5

Using Spring Security 3.1, try this:

<authentication-manager alias="authenticationManager">
    <authentication-provider user-service-ref="service">
        <password-encoder hash="sha"/>
        <jdbc-user-service data-source-ref="dataSource"/>
    </authentication-provider>
</authentication-manager>

<beans:bean id="dataSource" ...>
    ...
</beans:bean>

<beans:bean id="service" class="org.springframework.security.core.userdetails.jdbc.JdbcDaoImpl">
        <beans:property name="dataSource" ref="dataSource"/>
        ...
</beans:bean>

What's new: authentication-provider points to service and service points to datasource.

Edit: In Java you will have to encode the password with something like this:

DigestUtils.sha(request.getParameter("password"));

Warn: Be careful! Do not mix SHA with MD5!

If you set the password-encoder of the authentication-provider as SHA, you need to encode in Java the same way to keep consistent. But if you enconde in Java as MD5, as the sample you found, do not forget to set the hash to "md5". DigestUtils also provides md5 encoder:

DigestUtils.md5(request.getParameter("password"));

edited Aug 15, 2014 at 23:06

answered Dec 15, 2011 at 14:22

falsarella

12.5k10 gold badges75 silver badges119 bronze badges

7 Comments

sergionni Over a year ago

yes,I know,but you didn't ask on my question how to provide,that user password saved encoded to DB

falsarella Over a year ago

Well, I don't know what you mean by provide, but to persist, I have used DigestUtils.

falsarella Over a year ago

@sergionni: sorry, but I don't know a configuration of applicationContext to automatically save the password encoded, as I said, I have used DigestUtils from Apache commons.

sergionni Over a year ago

thank you for point,never heard about digest.So,should I provide digest in order my password to be encrypted?this example:static.springsource.org/spring-security/site/docs/3.0.x/…

sergionni Over a year ago

ahhh,looks like I understand, I should encode my password in Java DAO class, when persisting my UserDetails entity with following:MessageDigest messageDigest = MessageDigest.getInstance("MD5"); ...here is full explanation:stackoverflow.com/questions/1821082/spring-security-encypt-md5

|

Alireza Fattahi · Accepted Answer · 2016-12-26 06:33:09Z

4

Just a tip for doing it with annotations

@Configuration
@EnableWebSecurity
@PropertySource("classpath://configs.properties")
public class SecurityContextConfig extends WebSecurityConfigurerAdapter {


@Autowired
@Qualifier("userDetailsService")
private UserDetailsService userDetailsService;

@Autowired
public void configureGlobal(AuthenticationManagerBuilder auth) throws Exception {
    auth.userDetailsService(userDetailsService).passwordEncoder(getPasswordEncoder());
}


@Bean(name = "passwordEncoder")
public PasswordEncoder getPasswordEncoder(){
    return new BCryptPasswordEncoder();     
 }

}

answered Dec 26, 2016 at 6:33

Alireza Fattahi

46.1k18 gold badges134 silver badges188 bronze badges

Comments

maoyang · Accepted Answer · 2014-08-31 10:27:03Z

The accepted answer is right. I tested it with spring 3.1 and BCrypt encode algorithm.

When create a user.

PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
userEntity.setPassword(passwordEncoder.encode(userEntity.getPassword()));
userDao.save(userEntity);

When the user login, Remember, use the plain password (not hashed). just like:

Authentication request = new UsernamePasswordAuthenticationToken(user.getUserName(), user.getPassword());
Authentication result = authenticationManager.authenticate(request);
SecurityContextHolder.getContext().setAuthentication(result);

Here is security-config:

    <bean id="encoder" class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

<bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
        <property name="userDetailsService" ref="userService" />
        <property name="hideUserNotFoundExceptions" value="false" />
        <property name="passwordEncoder" ref="encoder" />
    </bean>

Hope it will help somebody!

z0mb1ek · Accepted Answer · 2013-04-11 15:17:33Z

1

with 3.1.x this mapping doesnt work for auth. Working way is:

<beans:bean id='bCryptPasswordEncoder' class='org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder'></beans:bean>

<authentication-manager>
  <authentication-provider user-service-ref="userDetailsService">
          <password-encoder ref="bCryptPasswordEncoder"/>
  </authentication-provider>
</authentication-manager>

answered Apr 11, 2013 at 15:17

z0mb1ek

1,00510 silver badges17 bronze badges

Collectives™ on Stack Overflow

Spring Security:password encoding in DB and in applicationContext

7 Answers 7

9 Comments

1 Comment

Comments

7 Comments

Comments

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

7 Answers 7

9 Comments

1 Comment

Comments

7 Comments

Comments

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related