[ https://jira.jboss.org/jira/browse/JBSEAM-3942?page=com.atlassian.jira.pl... ] Raimund Hölle updated JBSEAM-3942: ---------------------------------- Description: LdapIdentityStore.changePassword() stores the new password always as plain text in the LDAP database. To allow crypted passwords, i suggest the following modifications (currently tested only with OpenLDAP, MS AD may need encoding "UTF16-EL"): New bean properties (along with getter / setter): private String passwordCryptAlgorithm = ""; // Default: plain text as previous releases, set it to "SHA", "MD5", ... in components.xml (see java.security.MessageDigest) private String passwordEncoding = "UTF-8"; // Needed only if algorithm != "" Extend changePassword() by one additional line: public boolean changePassword(String name, String password) { InitialLdapContext ctx = null; try { ctx = initialiseContext(); // crypt password if not already done password = cryptPwIfNeeded(password); BasicAttribute passwordAttrib = new BasicAttribute(getUserPasswordAttribute(), password); New Helpers method: private Pattern cryptedPwRegexp = Pattern.compile("^[{].+[}].+"); private String cryptPwIfNeeded(String password) { // only crypt if requested by algorithm and not already done! if (getPasswordCryptAlgorithm() != null && ! getPasswordCryptAlgorithm().equals("") && ! cryptedPwRegexp.matcher(password).matches()) { try { MessageDigest md; md = MessageDigest.getInstance(getPasswordCryptAlgorithm()); md.reset(); md.update(password.getBytes(getPasswordEncoding())); byte[] result = md.digest(); password = "{" + getPasswordCryptAlgorithm() + "}" + (new BASE64Encoder()).encode(result); } catch ( NoSuchAlgorithmException e ) { throw new IdentityManagementException( "Configuration problem - can not crypt password with algorithm " + getPasswordCryptAlgorithm(), e); } catch ( UnsupportedEncodingException e ) { throw new IdentityManagementException( "Configuration problem - can not encode password with " + getPasswordEncoding(), e); } } return password; } Many regards, Raimund was: LdapIdentityStore.changePassword() stores the new password always as plain text in the LDAP database. To allow crypted passwords, i suggest the following modifications: New bean properties (along with getter / setter): private String passwordCryptAlgorithm = "SHA"; // Or "" for plain text, "MD5", ... private String passwordEncoding = "UTF-8"; Extend changePassword() by one additional line: public boolean changePassword(String name, String password) { InitialLdapContext ctx = null; try { ctx = initialiseContext(); // crypt password if not already done password = cryptPwIfNeeded(password); BasicAttribute passwordAttrib = new BasicAttribute(getUserPasswordAttribute(), password); New Helpers method: private Pattern cryptedPwRegexp = Pattern.compile("^[{].+[}].+"); private String cryptPwIfNeeded(String password) { // only crypt if requested by algorithm and not already done! if (getPasswordCryptAlgorithm() != null && ! getPasswordCryptAlgorithm().equals("") && ! cryptedPwRegexp.matcher(password).matches()) { try { MessageDigest md; md = MessageDigest.getInstance(getPasswordCryptAlgorithm()); md.reset(); md.update(password.getBytes(getPasswordEncoding())); byte[] result = md.digest(); password = "{" + getPasswordCryptAlgorithm() + "}" + (new BASE64Encoder()).encode(result); } catch ( NoSuchAlgorithmException e ) { throw new IdentityManagementException( "Configuration problem - can not crypt password with algorithm " + getPasswordCryptAlgorithm(), e); } catch ( UnsupportedEncodingException e ) { throw new IdentityManagementException( "Configuration problem - can not encode password with " + getPasswordEncoding(), e); } } return password; } Many regards, Raimund Complexity: Low -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira

[ https://jira.jboss.org/browse/JBSEAM-3942?page=com.atlassian.jira.plugin.... ] Shane Bryzak resolved JBSEAM-3942. ---------------------------------- Resolution: Out of Date We now use PicketLink for identity management -- This message is automatically generated by JIRA. - If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/secure/Administrators.jspa - For more information on JIRA, see: http://www.atlassian.com/software/jira