10:59 p.m.
I am using JBoss 4.2.2GA application server with Struts and EJB.
I am trying to encrypt the password using the message digest - MD5(given below) and store
it in the mysql DB.
Using DatabaseServerLoginModule, I am trying to authenticate, but it's failing. Please
help on this.
Please help whether any configuration setting needs to be done.
login.config.xml
==================
| <application-policy name="testDB">
| <authentication>
| <login-module
code="org.jboss.security.auth.spi.DatabaseServerLoginModule"
| flag="required">
|
| <module-option name="hashAlgorithm">MD5</module-option>
| <module-option
name="hashEncoding">base64</module-option>
| <module-option
name="hashUserPassword">true</module-option>
| <module-option
name="hashStorePassword">true</module-option>
|
| <module-option
name="dsJndiName">java:/MySqlDS</module-option>
| <module-option name="principalsQuery">
| select passwd from Users username where
username=?</module-option>
| <module-option name="rolesQuery">
| select userRoles, 'Roles' from UserRoles where
username=?</module-option>
| </login-module>
| </authentication>
| </application-policy>
|
I am using the below program to encrypt the password using MD5 and storing the encrypted
value "5f4dcc3b5aa765d61d8327deb882cf99" in mysql table
| import java.security.MessageDigest;
| import java.security.NoSuchAlgorithmException;
|
| public class MainClass {
| public static void main(String args[]) throws Exception {
| String sessionid = "password";
| byte[] defaultBytes = sessionid.getBytes();
| System.out.println("defaultBytes ::"+defaultBytes);
| try{
| MessageDigest algorithm = MessageDigest.getInstance("MD5");
| algorithm.reset();
| algorithm.update(defaultBytes);
| byte messageDigest[] = algorithm.digest();
|
| StringBuffer hexString = new StringBuffer();
| for (int i=0;i<messageDigest.length;i++) {
| hexString.append(Integer.toHexString(0xFF & messageDigest));
| }
| String foo = messageDigest.toString();
| System.out.println("sessionid "+sessionid+" md5 version is
"+hexString.toString());
| System.out.println("foo "+foo);
| sessionid=hexString+"";
| }catch(NoSuchAlgorithmException nsae){
|
| }
| }
| }
|
| output:
| -------
| defaultBytes ::[B@192d342
| sessionid password md5 version is 5f4dcc3b5aa765d61d8327deb882cf99
| foo [B@167d940
|
my mysql tables
| mysql> select * from userroles;
| +----------+-----------+
| | username | userRoles |
| +----------+-----------+
| | ram | admin |
| | sachin | guest |
| | tiger | admin |
| +----------+-----------+
| 3 rows in set (0.14 sec)
|
| mysql> select * from users;
| +----------+----------------------------------+
| | username | passwd |
| +----------+----------------------------------+
| | ram | passwd |
| | sachin | passwd |
| | tiger | 5f4dcc3b5aa765d61d8327deb882cf99 |
| +----------+----------------------------------+
| 3 rows in set (0.17 sec)
|
Geting the error message:
| 19:51:29,212 DEBUG [DatabaseServerLoginModule] Bad password for username=tiger
|
web.xml
==========
| <security-constraint>
| <web-resource-collection>
| <web-resource-name>Testing</web-resource-name>
| <url-pattern>/*</url-pattern>
| <http-method>GET</http-method>
| <http-method>POST</http-method>
| </web-resource-collection>
|
| <auth-constraint>
| <role-name>admin</role-name>
| </auth-constraint>
|
| <user-data-constraint>
| <transport-guarantee>CONFIDENTIAL</transport-guarantee>
| </user-data-constraint>
|
| </security-constraint>
|
| <login-config>
| <auth-method>FORM</auth-method>
| <form-login-config>
| <form-login-page>/login.jsp</form-login-page>
| <form-error-page>/error.jsp</form-error-page>
| </form-login-config>
| </login-config>
|
| <security-role>
| <role-name>admin</role-name>
| </security-role>
|
But for the userid: ram and passwd, I am able to login. Whereas for the user
"tiger" with the encrypted password, I couldn't able to login.
Please throw some light on it. Please help to check the configuration in login-config.xml
And I have an another doubt. If the user is attempting to enter invalid password for more
than 5 times, we need to lock his account.
Whether JBoss' DatabaseServerLoginModule or any other loginmodule is providing this
functionality? If not, how to achieve?]
View the original post :
http://www.jboss.org/index.html?module=bb&op=viewtopic&p=4229602#...
Reply to the post :
http://www.jboss.org/index.html?module=bb&op=posting&mode=reply&a...