In what encryption type are passwords of wso2 user table (um_user) in wso2_shared_db stored?

Question

According to the official documentation information about users of wso2 identity server reside in the um_user table of wso2_shared_db . The question I would like to ask is in what encryption type passwords in the um_user are stored?

Answer 1

By default, user passwords are hashed using SHA256 with a random salt. The hashing algorithm is configurable with the PasswordDigest property like below.

[user_store.properties]
PasswordDigest = "SHA-256"
StoreSaltedPassword = true

PS: As a general practice, passwords are stored as hashes which do not allow fiding the plain text value. If passwords are encrypted, the plain text values can be found.