Skip to content

Commit 2dbdc46

Browse files
Vijayendra Bhamidipatiminchen07
Vijayendra Bhamidipati
authored and
minchen07
committed
CLOUDSTACK-1734: Make SHA1 default password encoding mechanism
Description: Making SHA256SALT the default encoding algorithm to encode passwords when creating/updating users. Introducing a new configurable list to allow admins to separately configure the order of preference for encoding and authentication schemes. Since passwords are now sent by clients as clear text, fixing the Plain text authenticator to check against the password passed in rather than its md5 digest.
1 parent 58c962e commit 2dbdc46

13 files changed

Lines changed: 99 additions & 93 deletions

File tree

‎api/src/org/apache/cloudstack/api/command/admin/account/CreateAccountCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -63,7 +63,7 @@ public class CreateAccountCmd extends BaseCmd {
6363
@Parameter(name=ApiConstants.LASTNAME, type=CommandType.STRING, required=true, description="lastname")
6464
private String lastName;
6565

66-
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, required=true, description="Hashed password (Default is MD5). If you wish to use any other hashing algorithm, you would need to write a custom authentication adapter See Docs section.")
66+
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, required=true, description="Clear text password (Default hashed to SHA256SALT). If you wish to use any other hashing algorithm, you would need to write a custom authentication adapter See Docs section.")
6767
private String password;
6868

6969
@Parameter(name=ApiConstants.TIMEZONE, type=CommandType.STRING, description="Specifies a timezone for this command. For more information on the timezone parameter, see Time Zone Format.")

‎api/src/org/apache/cloudstack/api/command/admin/user/CreateUserCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -56,7 +56,7 @@ public class CreateUserCmd extends BaseCmd {
5656
@Parameter(name=ApiConstants.LASTNAME, type=CommandType.STRING, required=true, description="lastname")
5757
private String lastname;
5858

59-
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, required=true, description="Hashed password (Default is MD5). If you wish to use any other hashing algorithm, you would need to write a custom authentication adapter See Docs section.")
59+
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, required=true, description="Clear text password (Default hashed to SHA256SALT). If you wish to use any other hashing algorithm, you would need to write a custom authentication adapter See Docs section.")
6060
private String password;
6161

6262
@Parameter(name=ApiConstants.TIMEZONE, type=CommandType.STRING, description="Specifies a timezone for this command. For more information on the timezone parameter, see Time Zone Format.")

‎api/src/org/apache/cloudstack/api/command/admin/user/UpdateUserCmd.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public class UpdateUserCmd extends BaseCmd {
5959
@Parameter(name=ApiConstants.LASTNAME, type=CommandType.STRING, description="last name")
6060
private String lastname;
6161

62-
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, description="Hashed password (default is MD5). If you wish to use any other hasing algorithm, you would need to write a custom authentication adapter")
62+
@Parameter(name=ApiConstants.PASSWORD, type=CommandType.STRING, description="Clear text password (default hashed to SHA256SALT). If you wish to use any other hasing algorithm, you would need to write a custom authentication adapter")
6363
private String password;
6464

6565
@Parameter(name=ApiConstants.SECRET_KEY, type=CommandType.STRING, description="The secret key for the user. Must be specified with userApiKey")

‎client/tomcatconf/applicationContext.xml.in‎

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -379,6 +379,60 @@
379379
<bean id="LDAPUserAuthenticator" class="com.cloud.server.auth.LDAPUserAuthenticator">
380380
<property name="name" value="LDAP"/>
381381
</bean>
382+
<bean id="SHA256SaltedUserAuthenticator" class="com.cloud.server.auth.SHA256SaltedUserAuthenticator">
383+
<property name="name" value="SHA256SALT"/>
384+
</bean>
385+
<bean id="PlainTextUserAuthenticator" class="com.cloud.server.auth.PlainTextUserAuthenticator">
386+
<property name="name" value="PLAINTEXT"/>
387+
</bean>
388+
389+
<bean id="accountManagerImpl" class="com.cloud.user.AccountManagerImpl" >
390+
<property name="UserAuthenticators">
391+
<list>
392+
<ref bean="SHA256SaltedUserAuthenticator"/>
393+
<ref bean="MD5UserAuthenticator"/>
394+
<ref bean="LDAPUserAuthenticator"/>
395+
<ref bean="PlainTextUserAuthenticator"/>
396+
</list>
397+
</property>
398+
<property name="UserPasswordEncoders">
399+
<list>
400+
<ref bean="SHA256SaltedUserAuthenticator"/>
401+
<ref bean="MD5UserAuthenticator"/>
402+
<ref bean="LDAPUserAuthenticator"/>
403+
<ref bean="PlainTextUserAuthenticator"/>
404+
</list>
405+
</property>
406+
<property name="SecurityCheckers">
407+
<list>
408+
<ref bean="domainChecker"/>
409+
</list>
410+
</property>
411+
</bean>
412+
413+
<bean id="managementServerImpl" class ="com.cloud.server.ManagementServerImpl">
414+
<property name="UserAuthenticators">
415+
<list>
416+
<ref bean="SHA256SaltedUserAuthenticator"/>
417+
<ref bean="MD5UserAuthenticator"/>
418+
<ref bean="LDAPUserAuthenticator"/>
419+
<ref bean="PlainTextUserAuthenticator"/>
420+
</list>
421+
</property>
422+
<property name="UserPasswordEncoders">
423+
<list>
424+
<ref bean="SHA256SaltedUserAuthenticator"/>
425+
<ref bean="MD5UserAuthenticator"/>
426+
<ref bean="LDAPUserAuthenticator"/>
427+
<ref bean="PlainTextUserAuthenticator"/>
428+
</list>
429+
</property>
430+
<property name="HostAllocators">
431+
<list>
432+
<ref bean="FirstFitRouting"/>
433+
</list>
434+
</property>
435+
</bean>
382436

383437
<!--
384438
Network Elements

‎client/tomcatconf/componentContext.xml.in‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -40,34 +40,6 @@
4040
<!--
4141
Managers & pluggable adapters configuration under OSS deployment
4242
-->
43-
<bean id="accountManagerImpl" class="com.cloud.user.AccountManagerImpl" >
44-
<property name="UserAuthenticators">
45-
<list>
46-
<ref bean="MD5UserAuthenticator"/>
47-
<ref bean="LDAPUserAuthenticator"/>
48-
</list>
49-
</property>
50-
<property name="SecurityCheckers">
51-
<list>
52-
<ref bean="domainChecker"/>
53-
</list>
54-
</property>
55-
</bean>
56-
57-
<bean id="managementServerImpl" class ="com.cloud.server.ManagementServerImpl">
58-
<property name="UserAuthenticators">
59-
<list>
60-
<ref bean="MD5UserAuthenticator"/>
61-
<ref bean="LDAPUserAuthenticator"/>
62-
</list>
63-
</property>
64-
<property name="HostAllocators">
65-
<list>
66-
<ref bean="FirstFitRouting"/>
67-
</list>
68-
</property>
69-
</bean>
70-
7143
<bean id="storageManagerImpl" class="com.cloud.storage.StorageManagerImpl">
7244
<property name="StoragePoolAllocators">
7345
<list>

‎client/tomcatconf/nonossComponentContext.xml.in‎

Lines changed: 0 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -131,34 +131,6 @@
131131
<!--
132132
Managers & pluggable adapters configuration under non-OSS deployment
133133
-->
134-
<bean id="accountManagerImpl" class="com.cloud.user.AccountManagerImpl" >
135-
<property name="UserAuthenticators">
136-
<list>
137-
<ref bean="MD5UserAuthenticator"/>
138-
<ref bean="LDAPUserAuthenticator"/>
139-
</list>
140-
</property>
141-
<property name="SecurityCheckers">
142-
<list>
143-
<ref bean="domainChecker"/>
144-
</list>
145-
</property>
146-
</bean>
147-
148-
<bean id="managementServerImpl" class ="com.cloud.server.ManagementServerImpl">
149-
<property name="UserAuthenticators">
150-
<list>
151-
<ref bean="MD5UserAuthenticator"/>
152-
<ref bean="LDAPUserAuthenticator"/>
153-
</list>
154-
</property>
155-
<property name="HostAllocators">
156-
<list>
157-
<ref bean="FirstFitRouting"/>
158-
</list>
159-
</property>
160-
</bean>
161-
162134
<bean id="storageManagerImpl" class="com.cloud.storage.StorageManagerImpl">
163135
<property name="StoragePoolAllocators">
164136
<list>

‎developer/developer-prefill.sql‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ INSERT INTO `cloud`.`user` (id, uuid, username, password, account_id, firstname,
3636
-- Add system user with encrypted password=password
3737
INSERT INTO `cloud`.`user` (id, uuid, username, password, account_id, firstname,
3838
lastname, email, state, created) VALUES (2, UUID(), 'admin', '5f4dcc3b5aa765d61d8327deb882cf99',
39-
'2', 'Admin', 'User', 'admin@mailprovider.com', 'enabled', NOW());
39+
'2', 'Admin', 'User', 'admin@mailprovider.com', 'disabled', NOW());
4040

4141
-- Add configurations
4242
INSERT INTO `cloud`.`configuration` (category, instance, component, name, value)

‎plugins/user-authenticators/ldap/src/com/cloud/server/auth/LDAPUserAuthenticator.java‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -151,7 +151,10 @@ public boolean authenticate(String username, String password, Long domainId, Map
151151
@Override
152152
public boolean configure(String name, Map<String, Object> params)
153153
throws ConfigurationException {
154-
super.configure(name, params);
154+
if (name == null) {
155+
name = "LDAP";
156+
}
157+
super.configure(name, params);
155158
return true;
156159
}
157160

‎plugins/user-authenticators/md5/src/com/cloud/server/auth/MD5UserAuthenticator.java‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -59,8 +59,12 @@ public boolean authenticate(String username, String password, Long domainId, Map
5959
return true;
6060
}
6161

62+
@Override
6263
public boolean configure(String name, Map<String, Object> params)
6364
throws ConfigurationException {
65+
if(name == null) {
66+
name = "MD5";
67+
}
6468
super.configure(name, params);
6569
return true;
6670
}

‎plugins/user-authenticators/plain-text/src/com/cloud/server/auth/PlainTextUserAuthenticator.java‎

Lines changed: 6 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,6 @@
2828

2929
import com.cloud.user.UserAccount;
3030
import com.cloud.user.dao.UserAccountDao;
31-
3231
import com.cloud.utils.exception.CloudRuntimeException;
3332

3433

@@ -43,45 +42,26 @@ public boolean authenticate(String username, String password, Long domainId, Map
4342
if (s_logger.isDebugEnabled()) {
4443
s_logger.debug("Retrieving user: " + username);
4544
}
45+
4646
UserAccount user = _userAccountDao.getUserAccount(username, domainId);
4747
if (user == null) {
4848
s_logger.debug("Unable to find user with " + username + " in domain " + domainId);
4949
return false;
5050
}
5151

52-
53-
MessageDigest md5;
54-
try {
55-
md5 = MessageDigest.getInstance("MD5");
56-
} catch (NoSuchAlgorithmException e) {
57-
throw new CloudRuntimeException("Error", e);
58-
}
59-
md5.reset();
60-
BigInteger pwInt = new BigInteger(1, md5.digest(password.getBytes()));
61-
62-
// make sure our MD5 hash value is 32 digits long...
63-
StringBuffer sb = new StringBuffer();
64-
String pwStr = pwInt.toString(16);
65-
int padding = 32 - pwStr.length();
66-
for (int i = 0; i < padding; i++) {
67-
sb.append('0');
68-
}
69-
sb.append(pwStr);
70-
71-
72-
// Will: The MD5Authenticator is now a straight pass-through comparison of the
73-
// the passwords because we will not assume that the password passed in has
74-
// already been MD5 hashed. I am keeping the above code in case this requirement changes
75-
// or people need examples of how to MD5 hash passwords in java.
76-
if (!user.getPassword().equals(sb.toString())) {
52+
if (!user.getPassword().equals(password)) {
7753
s_logger.debug("Password does not match");
7854
return false;
7955
}
8056
return true;
8157
}
8258

59+
@Override
8360
public boolean configure(String name, Map<String, Object> params)
8461
throws ConfigurationException {
62+
if (name == null) {
63+
name = "PLAINTEXT";
64+
}
8565
super.configure(name, params);
8666
return true;
8767
}

0 commit comments

Comments
 (0)