[jbossseam-issues] [JBoss JIRA] Created: (JBSEAM-3762) Make it possible to select password salt without overriding IdentityStore

Nikolay Elenkov (JIRA) jira-events at lists.jboss.org
Thu Nov 27 02:34:36 EST 2008

Make it possible to select password salt without overriding IdentityStore

                 Key: JBSEAM-3762
                 URL: https://jira.jboss.org/jira/browse/JBSEAM-3762
             Project: Seam
          Issue Type: Feature Request
          Components: Security
         Environment: Seam 2.1
            Reporter: Nikolay Elenkov

Currently, JpaIdentityStore uses the username as salt when hashing the user password. If you want to use a different property as salt, you need to override JpaIdentityStore.

Since the salt is usually stored together with the user principal, it would be easier to select the property used as salt by annotating it, without having to override the IdentityStore component. 
Using a randomly generated salt is a generally accepted practice, so it should also be possible to generate the salt value automatically when creating the user via IdentityManager's API.

A new annotation, UserPasswordSalt, to annotate property used as salt. Attributes:
  * generate=true|false -- whether to generate random value
  * length=salt length in bits (used when generate=true)

Example usage:

class User {

  @UserPasswordSalt(generate=true, length=64)
  String getSalt() {..}

 String getPasswordHash() {...}


This message is automatically generated by JIRA.
If you think it was sent incorrectly contact one of the administrators: https://jira.jboss.org/jira/secure/Administrators.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira


More information about the seam-issues mailing list