Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SEC-1905: DigestAuthenticationFilter documentation is misleading #2136

Closed
spring-projects-issues opened this issue Jan 31, 2012 · 1 comment
Assignees
Labels
in: docs An issue in Documentation or samples type: bug A general bug type: jira An issue that was migrated from JIRA
Milestone

Comments

@spring-projects-issues
Copy link

spring-projects-issues commented Jan 31, 2012

Bruce (Migrated from SEC-1905) said:

At http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#digest-processing-filter
Section 10.2.1 states "The configured UserDetailsService is needed because DigestAuthenticationFilter must have direct access to the clear text password of a user. Digest Authentication will NOT work if you are using encoded passwords in your DAO"

This is a bit misleading.

The Password just needs to be hashed as MD5(username:realm:password) and then the filter must have the passwordAlreadEncoded attribute
set to true. Care must be taken to ensure that the realm for the DigestAuthenticationEntryPoint is set to the same value that is used by the MD5 Hash.

The hash can be easily found with
String DigestAuthUtils.encodePasswordInA1Format(String username, String realm, String password)
In the org.springframework.security.web.authentication.www package.

@spring-projects-issues
Copy link
Author

spring-projects-issues commented Jul 11, 2012

Rob Winch said:

I have added a footnote that clarifies this point.

@spring-projects-issues spring-projects-issues added in: docs An issue in Documentation or samples Closed type: bug A general bug type: jira An issue that was migrated from JIRA labels Feb 5, 2016
@spring-projects-issues spring-projects-issues added this to the 3.1.2 milestone Feb 5, 2016
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: docs An issue in Documentation or samples type: bug A general bug type: jira An issue that was migrated from JIRA
Projects
None yet
Development

No branches or pull requests

2 participants