[
https://issues.apache.org/jira/browse/KARAF-6925?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17248788#comment-17248788
]
ASF GitHub Bot commented on KARAF-6925:
---------------------------------------
jbonofre commented on pull request #1259:
URL: https://github.com/apache/karaf/pull/1259#issuecomment-744253804
As said, I will rework this one to avoid Spring bundles dependency and
prefer spring-security embedded. I will do that tomorrow. Thanks !
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
[email protected]
> Support stronger JAAS Encryption algorithms via spring-security-crypto
> ----------------------------------------------------------------------
>
> Key: KARAF-6925
> URL: https://issues.apache.org/jira/browse/KARAF-6925
> Project: Karaf
> Issue Type: Improvement
> Components: karaf
> Reporter: Colm O hEigeartaigh
> Assignee: Jean-Baptiste Onofré
> Priority: Major
> Labels: encryption
> Fix For: 4.2.11, 4.3.1
>
>
> Right now for JAAS password encryption, we only support basic digest
> algorithms, or else salted algorithms via the jasypt provider. However these
> are no longer considered secure, instead best practice is to use algorithms
> like scrypt, bcrypt, argon2, etc.
> The Spring Security Crypto project has password encoders for all of these
> algorithms, and has minimal dependencies, so we can leverage this to support
> a more modern encryption alternative.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
