Use OrientDB security manager to check password

skwidge · Aug 4, 2016 · 223bbe6 · 223bbe6
1 parent 53ae01a
commit 223bbe6
Show file tree

Hide file tree

Showing 2 changed files with 10 additions and 36 deletions.
diff --git a/pom.xml b/pom.xml
@@ -4,7 +4,7 @@
 
 	<groupId>com.ashtonit</groupId>
 	<artifactId>odbresource</artifactId>
-	<version>2.1.2</version>
+	<version>2.1.3</version>
 	<packaging>jar</packaging>
 
 	<name>OdbResource</name>

diff --git a/src/main/java/com/ashtonit/odb/realm/OdbRealm.java b/src/main/java/com/ashtonit/odb/realm/OdbRealm.java
@@ -2,7 +2,6 @@
 
 import static com.ashtonit.odb.realm.Version.VERSION;
 
-import java.security.NoSuchAlgorithmException;
 import java.security.Principal;
 import java.security.cert.X509Certificate;
 import java.util.ArrayList;
@@ -14,14 +13,14 @@
 import javax.naming.InitialContext;
 import javax.naming.NamingException;
 
-import org.apache.catalina.realm.MessageDigestCredentialHandler;
 import org.apache.catalina.realm.RealmBase;
 import org.ietf.jgss.GSSContext;
 
 import com.orientechnologies.orient.core.db.OPartitionedDatabasePool;
 import com.orientechnologies.orient.core.db.OPartitionedDatabasePoolFactory;
 import com.orientechnologies.orient.core.db.document.ODatabaseDocumentTx;
 import com.orientechnologies.orient.core.record.impl.ODocument;
+import com.orientechnologies.orient.core.security.OSecurityManager;
 import com.orientechnologies.orient.core.sql.query.OSQLSynchQuery;
 
 
@@ -70,8 +69,6 @@ public class OdbRealm extends RealmBase {
     private static final String PASSWORD = "password";
     private static final String ROLES = "roles";
     private static final String SELECT = "select from OUser where name = ?";
-    private static final String SHA256 = "SHA-256";
-    private static final String SHA256_PREFIX = "{SHA-256}";
 
     private String dbPass;
     private String dbResource;
@@ -80,22 +77,6 @@ public class OdbRealm extends RealmBase {
     private OPartitionedDatabasePool pool;
 
 
-    /**
-     * The default constructor sets the SHA-256 message digest credential handler.
-     */
-    public OdbRealm() {
-        final MessageDigestCredentialHandler handler = new MessageDigestCredentialHandler();
-        try {
-            handler.setAlgorithm(SHA256);
-        } catch (final NoSuchAlgorithmException e) {
-            containerLog.error("Authentication failed: dbUrl=" + dbUrl, e);
-            log.severe("authenticate(String, String): dbUrl=" + dbUrl);
-            log.throwing(OdbRealm.class.getName(), "authenticate(String, String)", e);
-        }
-        setCredentialHandler(handler);
-    }
-
-
     /**
      * This method of authentication is not supported by this implementation.
      *
@@ -150,8 +131,14 @@ public Principal authenticate(final String username, final String password) {
         try {
             db = getDb();
             final ODocument document = getODocument(db, username);
-
-            if (getCredentialHandler().matches(password, getPassword(document))) {
+            if (document == null) {
+                return null;
+            }
+            final String hash = document.field(PASSWORD);
+            if (hash == null) {
+                return null;
+            }
+            if (OSecurityManager.instance().checkPassword(password, hash)) {
                 final List<String> roles = getRoles(document);
                 return new OdbPrincipal(username, password, roles, dbUrl);
             }
@@ -314,19 +301,6 @@ private final ODocument getODocument(final ODatabaseDocumentTx db, final String
     }
 
 
-    private String getPassword(final ODocument document) throws NoSuchAlgorithmException {
-        if (document != null) {
-            final String password = document.field(PASSWORD);
-            if (password != null && password.startsWith(SHA256_PREFIX)) {
-                // MessageDigestCredentialHandler cannot handle the prefix.
-                return password.substring(SHA256_PREFIX.length());
-            }
-            return password;
-        }
-        return null;
-    }
-
-
     private final List<String> getRoles(final ODocument document) {
         final List<String> roles = new ArrayList<String>();
         if (document != null) {