Storing User Passwords Securely (A.E) planned?

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-20-2013 09:22 AM
Hi Activiti Core Team,
now i'm found, that the user passwords are stored as plain text. The Storage in this way is not a good solution (as well as store a "one-way hash" , "salt" the password before hashing, PER_USER_SALT + password - thay are bad solutions)
Are you planning the securely storing of the user passwords using jBCrypt, scrypt or Shiro or other security solutions?
If we want to implement the more Securely solutions like using jBcrypt for Activiti Explorer, what steps are needed?
i know currently the step number zero
: set the library like jBcrypt to the java class path
i suppose, that i need to implement own identity service (like following descriptions (1, 2)
Thanks
now i'm found, that the user passwords are stored as plain text. The Storage in this way is not a good solution (as well as store a "one-way hash" , "salt" the password before hashing, PER_USER_SALT + password - thay are bad solutions)
Are you planning the securely storing of the user passwords using jBCrypt, scrypt or Shiro or other security solutions?
If we want to implement the more Securely solutions like using jBcrypt for Activiti Explorer, what steps are needed?
i know currently the step number zero

i suppose, that i need to implement own identity service (like following descriptions (1, 2)
Thanks
Labels:
- Labels:
-
Archive
5 REPLIES 5
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-21-2013 03:51 AM
The explorer-app is intended as a "demo app", a good place to start. This is the reason why we're not putting in effort for password-encryption because this depends on the required implementation.
I'm not sure how that mechanism works you're suggesting, but if you get a piece of text in the end, that you can store as a password using the API. This would only require changing parts of the Activiti-explorer (user-creation and authentication) which is less drastically than altering user-management. If it's a more complex approach, you'll have to override the identity-stuff, indeed.
I'm not sure how that mechanism works you're suggesting, but if you get a piece of text in the end, that you can store as a password using the API. This would only require changing parts of the Activiti-explorer (user-creation and authentication) which is less drastically than altering user-management. If it's a more complex approach, you'll have to override the identity-stuff, indeed.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-21-2013 07:32 AM
I have to disagree with Frederik here (that can happen 😉 ). I do believe we should add encrypted password storage + salt hashing to the engine. It requires some changes probably in the command that is used to create a new user (when the password is passed in the User pojo object). So in theory, it would be easy to fix. However, if we want to add a salt, we need a new DB column too, and then some mapping changes.
I actually have it noted down on my todo list for the very near future.
I actually have it noted down on my todo list for the very near future.
Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-21-2013 07:36 AM
As mentioned above, hashing + salt is also not "safe enough" for the requirement

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-21-2013 07:42 AM
God point, missed that.
But still we should make it better than it now is 😉
But still we should make it better than it now is 😉

Options
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
‎03-21-2013 04:48 PM
…
I'm not sure how that mechanism works you're suggesting, but if you get a piece of text in the end, that you can store as a password using the API. This would only require changing parts of the Activiti-explorer (user-creation and authentication) which is less drastically than altering user-management. If it's a more complex approach, you'll have to override the identity-stuff, indeed.
Hi frederikheremans, and thank you for that tips

The explorer-app is intended as a "demo app", a good place to start. This is the reason why we're not putting in effort for password-encryption because this depends on the required implementation…….
i know, that Activiti Stack has two identity packages:
1. ActivitiExplorer-package, containing interfaces:
org.activiti.explorer.identity.LoggedInUser
org.activiti.explorer.ui.login.LoginHandler
And ..0.

Activiti Engine public stable packages and not stable techical public packages.
I write Engine because thay logically (imho) and "physically" (as JAR file activiti-engine) are part of activiti engine.
The examples of such javas are:
- org.activiti.engine.IdentityService
org.activiti.engine.identity.Group
org.activiti.engine.identity.User
org.activiti.engine.impl.identity.Authentication
org.activiti.engine.impl.persistence.entity.UserEntity
activiti.engine.impl.persistence.entity.UserEntityManager
org.activiti.engine.impl.persistence.entity.MembershipEntity
org.activiti.engine.impl.persistence.entity.GroupEntity
org.activiti.engine.impl.persistence.entity.GroupEntityManager
P.S Now i found such Shiro plugin in groovy
https://github.com/nickmancol/grails-activiti-shiro-security-plugin/blob/master/ActivitiShiroGrailsP...
with description ..in Spain language(?)
