spring security encode password with bcrypt algorithm

Question

i get something strange... in spring security for encode password..

i am trying to change my password and save it to database..but i always get error because defferent string..

like this..

in controller ..

println "password  = "+oldPass
println "password 1 = "+springSecurityService.encodePassword('password')
println "password 2 = "+springSecurityService.encodePassword('password')
println "password  = "+springSecurityService.encodePassword(oldPass)

and this ooutput

its strange...everytime i encodePassword, i will get different result.

i am using grails 3.0.5 and use bcrypt algorithm

grails.plugin.springsecurity.password.algorithm = 'bcrypt'

i put this line in application.groovy

like this

    // Added by the Spring Security Core plugin:
grails.plugin.springsecurity.userLookup.userDomainClassName = 'com.akiong.security.User'
grails.plugin.springsecurity.userLookup.authorityJoinClassName = 'com.akiong.security.UserRole'
grails.plugin.springsecurity.authority.className = 'com.akiong.security.Role'
grails.plugin.springsecurity.requestMap.className = 'com.akiong.security.RequestMap'
grails.plugin.springsecurity.securityConfigType = 'Requestmap'
grails.plugin.springsecurity.controllerAnnotations.staticRules = [
    '/':                ['permitAll'],
    '/error':           ['permitAll'],
    '/index':           ['permitAll'],
    '/index.gsp':       ['permitAll'],
    '/shutdown':        ['permitAll'],
    '/assets/**':       ['permitAll'],
    '/**/js/**':        ['permitAll'],
    '/**/css/**':       ['permitAll'],
    '/**/images/**':    ['permitAll'],
    '/**/favicon.ico':  ['permitAll']
]
grails.plugin.springsecurity.password.algorithm = 'bcrypt'

but when i create an user account with bootstrap and save it to database.. then i login ...it run with correctly..

btw, it's much easier for other people if you put code samples, output, etc in plain text instead of images. so it can be cited, or used for an experiment before answer — Igor Artamonov, Oct 23 '15 at 15:18

Igor Artamonov · Accepted Answer · 2015-10-23T14:50:34.157

3

It's a feature. bcrypt uses a random salt, so each time it generates a different hash even for same password.

If you want to check if entered password is valid, you need to use passwordEncoder.isPasswordvalid for Grails, like:

assert passwordEncoder.isPasswordValid( 
       '$2a$10$Qb7ENpWOSsFUS2UvwT1BRefZhn55roXPgUI8fjJRm6c/nR3JIQP8a',
       'password', null)
assert passwordEncoder.isPasswordValid(
       '$2a$10$sC3.yrmNn2VLS2Aer359rei/DxoLlwFq7s6ndAHm10ncyQpIr3MfO',
       'password', null)

or for plain Spring Security passwordEncoder.matches:

assert passwordEncoder.matches('password', 
       '$2a$10$Qb7ENpWOSsFUS2UvwT1BRefZhn55roXPgUI8fjJRm6c/nR3JIQP8a')
assert passwordEncoder.matches('password', 
       '$2a$10$sC3.yrmNn2VLS2Aer359rei/DxoLlwFq7s6ndAHm10ncyQpIr3MfO')

To autowire passwordEncoder bean just define it as a property of your class:

def passwordEncoder

edited Oct 23 '15 at 14:50

answered Oct 23 '15 at 13:35

Igor Artamonov

35,450
10
82
113

println "password 1 = "+passwordEncoder.matches('password','$2a$10$JNUJ3pRiwnOMkVYPRpbdeujyuBLTavozVLinHRnf5MK8VHkif2IGG')... i cannot use passwordEncoder – Oct 23 '15 at 14:07
did you wire it into your service/controller/etc? it's a bean provided by spring – Igor Artamonov Oct 23 '15 at 14:17
how? i dont know..i just add this grails.plugin.springsecurity.password.algorithm = 'bcrypt' to application.groovy – Oct 23 '15 at 14:22
oh did you mean call def springSecurityService? i wire it...thats why i can use springSecurityService.encodePassword – Oct 23 '15 at 14:30
no, I mean `passwordEncoder`, not `springSecurityService`. Also, actually I think Grails have different implementation, so method could be called `.isPasswordValid(hashed, 'password')`. See answer update – Igor Artamonov Oct 23 '15 at 14:47
see my update post..i get an error like that... i already add def passwordEncoder after def cityService – Oct 23 '15 at 14:58
when i try this assert `passwordEncoder.matches('password','$2a$10$JNUJ3pRiwnOMkVYPRpbdeujyuBLTavozVLinHRnf5MK8VHkif2IGG')`.. i get this error `No signature of method: grails.plugin.springsecurity.authentication.encoding.BCryptPasswordEncoder.matches()` – Oct 23 '15 at 15:02
yes, try `isPasswordValid(hashed, 'password', null)` – Igor Artamonov Oct 23 '15 at 15:15
can i know `isPasswordValid(, ,)`? – Oct 23 '15 at 15:22
1

`isPasswordValid(hashed, plainpassword, salt)`. you can't use salt for bcrypt, so it must be `null` – Igor Artamonov Oct 23 '15 at 15:24
If bcrypt uses a random salt each time, how can it ever find out if the user entered the correct password? it would hash to something different everytime...I don't understand. – temporary_user_name May 24 '16 at 20:24
@Aerovistae just get this salt from he hash, it's first 128bit/22chars from the hash. Or better use provided `passwordEncoder.matches` – Igor Artamonov May 25 '16 at 03:26

spring security encode password with bcrypt algorithm

1 Answers1

Linked