Re: [D2W] bring ERDEditPassword to hash passwords

And obviously I changed the ComponentName for the password confirmation property to point to the new component
100 : (pageConfiguration like 'EditUser*' and propertyKey = 'confirmPassword') => componentName = "ComponentPasswordConfirmationSHA256" [com.webobjects.directtoweb.Assignment]
Am 11.10.2013 um 11:03 schrieb Giancarlo Dessena <[email protected]>:

> Thank you for your Input, but I have found a simple solution that does not force me to modify my setters.
> I just extend the ERDeditPasswordConfirmation and hash the password right upon saving.
> Here a little snippet:
> 
> public class PasswordConfirmationSHA256extends ERDEditPasswordConfirmation {
>     public PasswordConfirmationSHA256(WOContext context) {
>         super(context);
>     }
>     
>     protected void checkPasswords() {
>         String password = password();
>         String passwordPropertyKey = passwordPropertyKey();
>         String passwordConfirm = passwordConfirm();
> 
>         if (password==null || password.equals("") || passwordConfirm==null || passwordConfirm.equals("")) {
>             // one or both is null or empty
>             if (objectKeyPathValue() == null) {
>                 fail("PasswordsFillBothFieldsException");
>             } else {
>                 // if we already have a value, then they need to both be null||empty
>                 if (!(password==null || password.equals("")) && (passwordConfirm==null || passwordConfirm.equals(""))) {
>                     fail("PasswordsFillBothFieldsException");
>                 }
>             }
>         } else {
>             // they are both non-null
>             if(!password.equals(passwordConfirm)) {
>                 fail("PasswordsDontMatchException");
>             } else {
>                 try {
>                     object().validateTakeValueForKeyPath(DigestUtility.sha256(password+System.getProperty("passwordSalt")), passwordPropertyKey);
>                 } catch(NSValidation.ValidationException ex) {
>                     validationFailedWithException(ex, password, passwordPropertyKey);
>                 }
>             }
>         }
>     }
> }
> 
> Am 09.10.2013 um 11:50 schrieb Mark Wardle <[email protected]>:
> 
>> Hi. I recently implemented password hashing using jasypt.
>> 
>> I created a property "encryptedPassword", and simply created a fake property like this in my user entity:
>> 
>> 	public void setPassword(String password) {
>> 		BasicPasswordEncryptor passwordEncryptor = new BasicPasswordEncryptor();
>> 		setEncryptedPassword(passwordEncryptor.encryptPassword(password));
>> 	}
>> 	public String password() {
>> 		return "";
>> 	}
>> 
>> 	public boolean canAuthenticateWithPassword(String password) {
>> 		if (encryptedPassword().equals(password)) return true;
>> 		BasicPasswordEncryptor passwordEncryptor = new BasicPasswordEncryptor();
>> 		try {
>> 			return passwordEncryptor.checkPassword(password, encryptedPassword());
>> 		}
>> 		catch (EncryptionOperationNotPossibleException e) {
>> 			log.error(e);
>> 		}
>> 		return false;
>> 	}
>> 
>> Which allows you to bind a D2W component to the password property and have it set appropriately.
>> 
>> To see whether a provided password matches the stored (hashed, encrypted) password, then simply call the canAuthenticateWithPassword() method.
>> 
>> Best wishes,
>> 
>> Mark
>> 
>> 
>> On 8 Oct 2013, at 19:24, Timothy Worman <[email protected]> wrote:
>> 
>>> Carlo:
>>> 
>>> You should investigate er.extensions.crypting.BCrypt and also search the webobjects dev list (instead of the Wonder list) for mentions of BCrypt. There are good pointers on hashing passwords.
>>> 
>>> Tim
>>> UCLA GSE&IS
>>> 
>>> On Oct 8, 2013, at 9:27 AM, Giancarlo Dessena <[email protected]> wrote:
>>> 
>>>> Hello everybody,
>>>> 
>>>> I have successfully enabled password editing using ERDEditPassword, but unfortunately I can not figure out how to set a hashing algorithm.
>>>> Is this even possible?
>>>> 
>>>> Greetings Carlo
>>>> ------------------------------------------------------------------------------
>>>> October Webinars: Code for Performance
>>>> Free Intel webinars can help you accelerate application performance.
>>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>>> the latest Intel processors and coprocessors. See abstracts and register >
>>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
>>>> _______________________________________________
>>>> Wonder-disc mailing list
>>>> [email protected]
>>>> https://lists.sourceforge.net/lists/listinfo/wonder-disc
>>> 
>>> 
>>> ------------------------------------------------------------------------------
>>> October Webinars: Code for Performance
>>> Free Intel webinars can help you accelerate application performance.
>>> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
>>> the latest Intel processors and coprocessors. See abstracts and register >
>>> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk
>>> _______________________________________________
>>> Wonder-disc mailing list
>>> [email protected]
>>> https://lists.sourceforge.net/lists/listinfo/wonder-disc
>> 
>> -- 
>> Dr. Mark Wardle
>> Consultant Neurologist, University Hospital Wales, Cardiff, UK
>> Email: [email protected] or [email protected]  Twitter: @mwardle
>> Telephone: 02920745274 (secretary) or facsimile: 02920744166
>> 
>> 
>> 
>> 
>> 
> 
> ------------------------------------------------------------------------------
> October Webinars: Code for Performance
> Free Intel webinars can help you accelerate application performance.
> Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
> the latest Intel processors and coprocessors. See abstracts and register >
> http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk_______________________________________________
> Wonder-disc mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/wonder-disc


------------------------------------------------------------------------------
October Webinars: Code for Performance
Free Intel webinars can help you accelerate application performance.
Explore tips for MPI, OpenMP, advanced profiling, and more. Get the most from 
the latest Intel processors and coprocessors. See abstracts and register >
http://pubads.g.doubleclick.net/gampad/clk?id=60134071&iu=/4140/ostg.clktrk