[英]Spring security password hash + salt
I am working with a legacy application that stored passwords in plaintext. 我正在使用以明文形式存储密码的遗留应用程序。 I have ported the application to spring 3 mvc + security.
我已将应用程序移植到spring 3 mvc + security。 I have also successfully gotten spring security handling the authentication and authorization using sha256 + a salt based on the username.
我还成功地使用sha256 +基于用户名的盐来获得Spring安全性处理认证和授权。 This all works great, however as part of the deployment, I will need to migrate the existing database to use the new password schema.
这一切都很好,但作为部署的一部分,我将需要迁移现有数据库以使用新密码模式。 I am not sure how spring security does it's password hashing with a salt, so i am unable to write a sql script that can be used to migrate the old plaintext passwords to the new sha256+salt schema.
我不确定Spring安全性如何使用salt进行密码散列,因此我无法编写可用于将旧明文密码迁移到新sha256 + salt模式的sql脚本。 Is there any documentation or resources that I can use to figure this out?
是否有任何文档或资源可用于解决这个问题?
This is documented in BasePasswordEncoder
: 这在
BasePasswordEncoder
有记录:
The generated password will be in the form of
password{salt}
.生成的密码将采用
password{salt}
的形式。
So in your case you can compute the salted password using this simple code: 因此,在您的情况下,您可以使用以下简单代码计算盐渍密码:
new ShaPasswordEncoder(256).encodePassword(oldPassword, randomSalt)
Note: ShaPasswordEncoder
extends BasePasswordEncoder
. 注意:
ShaPasswordEncoder
扩展了BasePasswordEncoder
。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.