Spring Security Encrypt MD5

Question

I have a java web application using spring framework and spring security for its login. In my database I have my passwords encrypted to MD5 before being saved. I added in my application-config.xml this codes

 <security:authentication-provider> <security:password-encoder hash="md5"/> <security:jdbc-user-service data-source-ref="dataSource" users-by-username-query="select user_name username, user_password password, 1 enabled from users where user_name=?" authorities-by-username-query="select username, authority from authorities where username=?" /> </security:authentication-provider>

At first It worked when the password in the db were not encrypted. But when I encrypted it and added this snippet in my application config

 <security:password-encoder hash="md5"/>

I am not able to login.

md5 is a hash function, not a method of encryption.

u0b34a0f6ae
– u0b34a0f6ae

2009-11-30 17:05:58 +00:00
Commented Nov 30, 2009 at 17:05 — u0b34a0f6ae
– u0b34a0f6ae, Commented Nov 30, 2009 at 17:05
what do you mean. What should have I done

cedric
– cedric

2009-11-30 17:24:53 +00:00
Commented Nov 30, 2009 at 17:24 — cedric
– cedric, Commented Nov 30, 2009 at 17:24

bh5k · Accepted Answer · 2010-05-20 22:09:39Z

I realize this is a little late, but Spring has built-in classes that make this a lot easier.

@Test public void testSpringEncoder() { PasswordEncoder encoder = new Md5PasswordEncoder(); String hashedPass = encoder.encodePassword("koala", null); assertEquals("a564de63c2d0da68cf47586ee05984d7", hashedPass); }

This is a unit test that I wrote using the built in Spring Security code, it is a lot smaller than the MessageDigest code and since you are using Spring Security already, you should have the classes in your classpath already.

Here's another answer with a bit more details on how to use it neatly in your Spring application.

labratmatt · Accepted Answer · 2009-12-01 03:36:20Z

How are you creating your MD5 hashes? Something like the following works well in Java:

MessageDigest messageDigest = MessageDigest.getInstance("MD5"); messageDigest.update(user.getPassword().getBytes(),0, user.getPassword().length()); String hashedPass = new BigInteger(1,messageDigest.digest()).toString(16); if (hashedPass.length() < 32) { hashedPass = "0" + hashedPass; }

When you encode "koala" do you get "a564de63c2d0da68cf47586ee05984d7"?

ah ok.. i missed the 16 in messageDigest.digest()).toString(16). thanks
actually, there can be less than 31 symbols. so. this won't work in some situations (very rare). you have to add "0" as long as you don't have 32 symbols

DJ. · Accepted Answer · 2009-11-30 18:42:07Z

Have you read 6.3.3 Hashing and Authentication section from Spring Security reference manual? It mentioned some possible issues that you might encounter in using password hashing.

Some possibilities it listed:

Database password hash might be in Base64, while the result from MD5PasswordEncoder is in hexadecimal strings
Your password hash might be in upper-case, while the result from the encoder is in lower case strings

Collectives™ on Stack Overflow

Spring Security Encrypt MD5

3 Answers 3

2 Comments

2 Comments

Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

3 Answers 3

2 Comments

2 Comments

Comments

Linked

Related