3

I am working with a legacy application that stored passwords in plaintext. I have ported the application to spring 3 mvc + security. I have also successfully gotten spring security handling the authentication and authorization using sha256 + a salt based on the username. This all works great, however as part of the deployment, I will need to migrate the existing database to use the new password schema. I am not sure how spring security does it's password hashing with a salt, so i am unable to write a sql script that can be used to migrate the old plaintext passwords to the new sha256+salt schema. Is there any documentation or resources that I can use to figure this out?

Tomasz Nurkiewicz
  • 334,321
  • 69
  • 703
  • 674
vikash dat
  • 1,494
  • 2
  • 19
  • 37
  • Have you tried to use their http://static.springsource.org/spring-security/site/docs/2.0.x/apidocs/org/springframework/security/providers/encoding/ShaPasswordEncoder.html?You also know the salt.So did you try to see if the hashing matches? – Cratylus Jan 24 '12 at 19:44
  • i've tried using a sha256 generator with the salt as both the prefix and suffix, but had no luck matching the password spring generates – vikash dat Jan 24 '12 at 20:01

2 Answers2

10

This is documented in BasePasswordEncoder:

The generated password will be in the form of password{salt}.

So in your case you can compute the salted password using this simple code:

new ShaPasswordEncoder(256).encodePassword(oldPassword, randomSalt)

Note: ShaPasswordEncoder extends BasePasswordEncoder.

mwojtera
  • 471
  • 4
  • 6
Tomasz Nurkiewicz
  • 334,321
  • 69
  • 703
  • 674
0
  1. If you are using the default password encode then the source seems useful. (Pick the branch appropiate for the version you are using).
  2. You can implement your own PasswordEncoder and define the way the salt is used.
madth3
  • 7,275
  • 12
  • 50
  • 74