topic Re: Encrypt Nuxeo password in database in Nuxeo Forum

Encrypt Nuxeo password in database

SMAH_Haider — Mon, 27 Aug 2012 07:35:27 GMT

We are using Nuxeo 5.6-RC2. We are connecting via oracle template. We have also customized nuxeo to use our customized pre-made users instead default nuxeo users.

Now, username and password Administrator and Administrator are placed in MY_CUSTOMIZED_USERS table, and obviously they are not encrypted. In production environment, users have access to database and they can see Administrator password.

Is there anyway we can customize Nuxeo to have our login passwords in database encrypted?

Re: Encrypt Nuxeo password in database

Wojciech_Sulejm — Mon, 27 Aug 2012 23:24:09 GMT

Only the initial Administrator password, that is the word "Administrator", is not encrypted as the assumption was made that it needs to be reset anyway to make it secure. The moment you change the Administrator password, it does get encrypted.

Please make a test and change your Administrator password and then query the users table to see if that indeed is the case.

Re: Encrypt Nuxeo password in database

SMAH_Haider — Tue, 28 Aug 2012 11:23:34 GMT

Thanks Wojciech I changed the password and as you said it got encrypted in database. But as we have made our custom users by making our own user directory.

Re: Encrypt Nuxeo password in database

Florent_Guillau — Thu, 30 Aug 2012 19:54:49 GMT

If <passwordHashAlgorithm>SSHA</passwordHashAlgorithm> is in the config then Nuxeo will encrypt any password it writes, but will still be able to read unencrypted ones.

If you populate the password database using an external system, then you'll have to do the encryption yourself. You can see how SSHA is implemented by reading the code at https://github.com/nuxeo/nuxeo-services/blob/master/nuxeo-platform-directory/nuxeo-platform-directory-sql/src/main/java/org/nuxeo/ecm/directory/sql/PasswordHelper.java

Re: Encrypt Nuxeo password in database

SMAH_Haider — Tue, 25 Sep 2012 08:14:32 GMT

Perfect. Thanks Florent.