[Building Sakai] Password encryption

[Shoji Kajita]

Hi James,

We are using PasswordService to authenticate Sakai local users
(including admin) by using CAS, based on the following CAS
AuthenticationHandler.

I hope this can be an example to use PasswordService.

package org.jasig.cas.adaptors.jdbc;

import org.jasig.cas.authentication.handler.AuthenticationException;
import org.jasig.cas.authentication.principal.UsernamePasswordCredentials;
import org.springframework.dao.IncorrectResultSizeDataAccessException;

import javax.validation.constraints.NotNull;

import org.sakaiproject.user.impl.PasswordService;

/**
 * Class that if provided a query that returns a password (parameter of query
 * must be username) will compare by using Sakai PasswordService.
 * 
 * @author Shoji Kajita
 * @version $Revision$ $Date$
 * @since 3.4
 */
public class QuerySakaiDatabaseAuthenticationHandler extends AbstractJdbcUsernamePasswordAuthenticationHandler {

    @NotNull
    private String sql;

    PasswordService pwdService;

    protected final boolean authenticateUsernamePasswordInternal(final UsernamePasswordCredentials credentials) throws AuthenticationException {
        final String username = getPrincipalNameTransformer().transform(credentials.getUsername());
        final String password = credentials.getPassword();
        
        pwdService = new PasswordService();    

        try {
            final String dbPassword = getJdbcTemplate().queryForObject(this.sql, String.class, username);
            return pwdService.check(password, dbPassword); 
        } catch (final IncorrectResultSizeDataAccessException e) {
            // this means the username was not found.
            return false;
        }
    }

    /**
     * @param sql The sql to set.
     */
    public void setSql(final String sql) {
        this.sql = sql;
    }
}

The bean setting in deployerConfig.xml is as follows:

  <bean class="org.jasig.cas.adaptors.jdbc.QuerySakaiDatabaseAuthenticationHandler"
      p:sql="select a.pw from sakai_user a, sakai_user_id_map b where a.user_id=b.user_id and b.eid=?"
  p:dataSource-ref="dataSource" />

Shoji

At Wed, 02 Oct 2013 11:33:55 +0200,
Miguel Carro Pellicer wrote:
> 
> https://source.sakaiproject.org/svn/kernel/trunk/kernel-impl/src/main/java/org/sakaiproject/user/impl/PasswordService.java
> 
> Regards, Miguel.
> 
> 
> El 02/10/2013 11:26, James Scoble escribió:
> > Hello
> >
> > I'm looking for the part of Sakai's source code in which the system
> > encrypts passwords entered by the user in order to compare them with the
> > one in the database.
> >
> > Where does that happen? I'm specifically wanting to see what encryption
> > method it uses.
> >
> > Which class actually does it?
> >
> >
> > Thanks.
> >
> >
> >
> > _______________________________________________
> > sakai-dev mailing list
> > sakai-dev at collab.sakaiproject.org
> > http://collab.sakaiproject.org/mailman/listinfo/sakai-dev
> >
> > TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe at collab.sakaiproject.org with a subject of "unsubscribe"
> >
> 
> -- 
> ########################
> Miguel Carro Pellicer
> Chief Operations Officer @ Samoo Elearning
> http://www.samoo.es
> ########################
> _______________________________________________
> sakai-dev mailing list
> sakai-dev at collab.sakaiproject.org
> http://collab.sakaiproject.org/mailman/listinfo/sakai-dev
> 
> TO UNSUBSCRIBE: send email to sakai-dev-unsubscribe at collab.sakaiproject.org with a subject of "unsubscribe"