使用Spring 3安全性对密码进行加密

Question

I was trying the whole day to find out or google, how to add salt to my hashed password during authentication via Spring 3 security and make it all to work together. Without salt it works just fine.

    <!-- authentication from database -->
    <security:authentication-manager>
        <security:authentication-provider>
            <security:password-encoder hash='md5'/> 
            <security:jdbc-user-service
                data-source-ref='dataSource'

                users-by-username-query="
              select username,password, salt
              from users where username=?"

                authorities-by-username-query="
              select u.username, ur.authority from users u, user_roles ur 
              where u.user_id = ur.user_id and u.username =?  " />

        </security:authentication-provider>
    </security:authentication-manager>

And if I'd like to create salted pasword, it's done just by user.setPassword(md5(somePassword+someSalt)); Thanks for any advice.

Answer 1

Spring security uses the following pattern for password encoding with salts:

 md5(password+"{"+salt+"}")

I would however use sha instead of md5.