Hi Ben, Colin et al
Configuring the JdbcDaoImpl and am having problems with the 2nd
authentication attempt:
Config snippet:
<bean id="daoAuthenticationProvider" class=
"net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider">
<property name="authenticationDao"><ref bean="authenticationDao"/></
property>
<property name="userCache"><ref bean="userCache"/></property>
<property name="saltSource"><ref bean="saltSource"/></property>
<property name="passwordEncoder"><ref bean="passwordEncoder"
/></property>
</bean>
<bean id="passwordEncoder" class=
"net.sf.acegisecurity.providers.encoding.Md5PasswordEncoder">
</bean>
Problem that occurs is that the first authentication attempt is successful
(passwords equal when debugging in Md5PasswordEncoder)
then I notice in the DaoAuthenticationManager the Authentication Token is
created.... like
return new UsernamePasswordAuthenticationToken(user.getUsername(),
user.getPassword(), user.getAuthorities());
At this point the user.getPassword() ... is the MD5-encoded password...
then all further attempts to authenticate... try to encode the already
encoded password (since Authentication token is cached)
My 2 questions are:
First, am I missing something? Like a configuration setting or otherwise?
Secondly, does the Authentication Token require to store the credentials
from the database or the credentials from the original request?
i.e. clear text vs. md5 encoded
To get around this and to get it working, I did something like this in line
197
net.sf.acegisecurity.providers.dao.DaoAuthenticationProvider
method --> public Authentication authenticate(Authentication
authentication)
// Mark St.Godard - should the encoded or clear text password be placed in
the token?
// return new UsernamePasswordAuthenticationToken(user.getUsername(),
// user.getPassword(), user.getAuthorities());
return new UsernamePasswordAuthenticationToken(user.getUsername(),
authentication.getCredentials(), user.getAuthorities());
I am sure I am missing something.
Any advise is appreciated.
And yes Ben, I am running on Websphere 5.1 (but that shouldnt matter ....
this is standard Java stuff :)
Thanks in advance,
Mark
-------------------------------------------------------
This SF.Net email sponsored by Black Hat Briefings & Training.
Attend Black Hat Briefings & Training, Las Vegas July 24-29 -
digital self defense, top technical experts, no vendor pitches,
unmatched networking opportunities. Visit www.blackhat.com
_______________________________________________
Acegisecurity-developer mailing list
[EMAIL PROTECTED]
https://lists.sourceforge.net/lists/listinfo/acegisecurity-developer
