Hi Sandor,
I've coded a better approach, created my own custom password encoder class,
where I still replace the "$2y$" for "$2a$" before checking it. The
attached file should be placed at
*cas-overlay/src/main/java/org/defrox/bcrypt* and set the parameter
cas.authn.jdbc.query[0].passwordEncoder.type=org.defrox.bcrypt.BCryptPasswordEncoder
Enjoy!
El martes, 3 de octubre de 2017, 12:19:55 (UTC+2), Sandor Juhasz escribió:
>
> Hi,
>
> workaround like this i have - without altering PHP related data. I was
> hoping more for a jbcrypt update.
> Here is ours:
>
> CREATE VIEW <DB>.<CAS_USER_TABLE> AS SELECT id, email, id as uid,
> CONCAT('$2a', SUBSTRING(password FROM 4)) as password FROM
> <DB>.<ORIGINAL_USER_TABLE> where password is not null;
>
>
> --
> *Sándor Juhász*
> System Administrator
> *ChemAxon* *Ltd*.
> Building Hx, GraphiSoft Park, Záhony utca 7, Budapest, Hungary, H-1031
> Cell: +36704258964
>
> On Tue, Oct 3, 2017 at 11:37 AM, Christian Axel Schmidt Dick <
> [email protected] <javascript:>> wrote:
>
>> Hi Sandor,
>>
>> Yes I am working on a workaround by creating a new table with usernames
>> and passwords and triggers to replace strings in passwords. Will post the
>> solution when done.
>>
>> CREATE TRIGGER CopyNewUser
>> AFTER INSERT ON m_user FOR EACH ROW INSERT INTO cas_user (id, username,
>> password, firstname, lastname) VALUES (NEW.id, NEW.username,
>> REPLACE(NEW.password, '$2y$10$', '$2a$10$'), NEW.firstname, NEW.lastname);
>>
>> https://dev.mysql.com/doc/refman/5.7/en/trigger-syntax.html
>>
>> Cheers,
>> Christian
>>
>>
>> El martes, 3 de octubre de 2017, 10:56:06 (UTC+2), Sandor Juhasz escribió:
>>>
>>> Hey,
>>>
>>> we had the exact same issue.
>>>
>>> You can create SQL view altering the given field.
>>>
>>> Would be interested as well in a general fix.
>>>
>>>
>>> On Monday, October 2, 2017 at 10:29:06 AM UTC+2, Christian Axel Schmidt
>>> Dick wrote:
>>>>
>>>> Hi there,
>>>>
>>>> I have an issue between CAS and Moodle (a PHP LMS) where the passwords
>>>> generated by PHP are encrypted with the fixed version of blowfish ($2y...)
>>>> but in CAS 5.1.x that is using Spring security the blowfish version is not
>>>> the fixed one ($2a...). Therefore I cant validate users. A manual fix is
>>>> to
>>>> change the $2y for $2a in the password and this works. Problem is that
>>>> this
>>>> can't be implemented. I've been trying to replace the Spring Security
>>>> Bcrypt library for JBcrypt library <https://github.com/jeremyh/jBCrypt>
>>>> but
>>>> I am new to the springframework and can't make it work. Tried to add it as
>>>> a dependency on the project file and in the cas config as a custom
>>>> password
>>>> encoder but no luck. What would be the best way to solve this? What is
>>>> your
>>>> advice and how should I proceed?
>>>> I am using CAS overlay 5.1.4
>>>>
>>>> Thanks in advance,
>>>> Christian
>>>>
>>>>
>>>> cas.authn.jdbc.query[0].sql=SELECT * FROM user WHERE username=?
>>>> cas.authn.jdbc.query[0].url=jdbc:mysql://localhost:3306/db
>>>> cas.authn.jdbc.query[0].dialect=org.hibernate.dialect.MySQLDialect
>>>> cas.authn.jdbc.query[0].user=root
>>>> cas.authn.jdbc.query[0].password=password
>>>> cas.authn.jdbc.query[0].driverClass=com.mysql.cj.jdbc.Driver
>>>> cas.authn.jdbc.query[0].fieldPassword=password
>>>> cas.authn.jdbc.query[0].autocommit=false
>>>>
>>>> cas.authn.jdbc.query[0].passwordEncoder.type=org.mindrot.jbrcypt
>>>>
>>>> cas.authn.jdbc.query[0].passwordEncoder.encodingAlgorithm=BLOWFISH
>>>> cas.authn.jdbc.query[0].passwordEncoder.characterEncoding=UTF-8
>>>>
>>>>
>>>> --
>> - Website: https://apereo.github.io/cas
>> - Gitter Chatroom: https://gitter.im/apereo/cas
>> - List Guidelines: https://goo.gl/1VRrw7
>> - Contributions: https://goo.gl/mh7qDG
>> ---
>> You received this message because you are subscribed to the Google Groups
>> "CAS Community" group.
>> To unsubscribe from this group and stop receiving emails from it, send an
>> email to [email protected] <javascript:>.
>> To view this discussion on the web visit
>> https://groups.google.com/a/apereo.org/d/msgid/cas-user/f7623b25-b25e-49d9-899b-1345287bdb09%40apereo.org
>>
>> <https://groups.google.com/a/apereo.org/d/msgid/cas-user/f7623b25-b25e-49d9-899b-1345287bdb09%40apereo.org?utm_medium=email&utm_source=footer>
>> .
>>
>
>
--
- Website: https://apereo.github.io/cas
- Gitter Chatroom: https://gitter.im/apereo/cas
- List Guidelines: https://goo.gl/1VRrw7
- Contributions: https://goo.gl/mh7qDG
---
You received this message because you are subscribed to the Google Groups "CAS
Community" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to [email protected].
To view this discussion on the web visit
https://groups.google.com/a/apereo.org/d/msgid/cas-user/efb95477-affd-4a71-aa0f-3dfaad32f2e6%40apereo.org.
/*
* Copyright 2002-2011 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.defrox.bcrypt;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.security.crypto.bcrypt.BCrypt;
import org.springframework.security.crypto.password.PasswordEncoder;
import java.security.SecureRandom;
import java.util.regex.Pattern;
/**
* Implementation of PasswordEncoder that uses the BCrypt strong hashing function. Clients
* can optionally supply a "strength" (a.k.a. log rounds in BCrypt) and a SecureRandom
* instance. The larger the strength parameter the more work will have to be done
* (exponentially) to hash the passwords. The default value is 10.
*
* @author Dave Syer
*
*/
public class BCryptPasswordEncoder implements PasswordEncoder {
private Pattern BCRYPT_PATTERN = Pattern
.compile("\\A\\$2a?\\$\\d\\d\\$[./0-9A-Za-z]{53}");
private final Log logger = LogFactory.getLog(getClass());
private final int strength;
private final SecureRandom random;
private final int MIN_LOG_ROUNDS = 4;
private final int MAX_LOG_ROUNDS = 31;
public BCryptPasswordEncoder() {
this(-1);
}
/**
* @param strength the log rounds to use, between 4 and 31
*/
public BCryptPasswordEncoder(int strength) {
this(strength, null);
}
/**
* @param strength the log rounds to use, between 4 and 31
* @param random the secure random instance to use
*
*/
public BCryptPasswordEncoder(int strength, SecureRandom random) {
if (strength != -1 && (strength < MIN_LOG_ROUNDS || strength > MAX_LOG_ROUNDS)) {
throw new IllegalArgumentException("Bad strength");
}
this.strength = strength;
this.random = random;
}
public String encode(CharSequence rawPassword) {
String salt;
if (strength > 0) {
if (random != null) {
salt = BCrypt.gensalt(strength, random);
}
else {
salt = BCrypt.gensalt(strength);
}
}
else {
salt = BCrypt.gensalt();
}
return BCrypt.hashpw(rawPassword.toString(), salt);
}
public boolean matches(CharSequence rawPassword, String encodedPassword) {
encodedPassword = encodedPassword.replace("$2y$", "$2a$");
if (encodedPassword == null || encodedPassword.length() == 0) {
logger.warn("Empty encoded password");
return false;
}
if (!BCRYPT_PATTERN.matcher(encodedPassword).matches()) {
logger.warn("Encoded password does not look like BCrypt");
return false;
}
return BCrypt.checkpw(rawPassword.toString(), encodedPassword);
}
}
