04-30-2019 06:56 AM
Good day.
I am developing a Java application that uses OpenCMIS to communicate with the Alfresco repository. Is it possible to set up a session with the Alfresco repository using a password hash? For example,
parameter.put (SessionParameter.USER, userName);
parameter.put (SessionParameter.PASSWORD, passwordHash);
And do not store it in clear?
05-01-2019 08:06 AM
No, it is not. Password hashing is supported by Alfresco, but it happens on the server-side for validation of provided passwords, and is not supported for parameters for creating the CMIS session. I also do not see how that would solve your issue - instead of storing the password in the clear, you would be storing the hash in the clear, which would grant any attacker as much access to Aflresco as if they had the password.
What you can do with Alfresco is the following:
A ticket is a runtime token linked to the user, and automatically expires after a (configurable) time of inactivity. If a ticket is obtained by an attacker, it would not fully compromise the user, as it would only be limited for a certain amount of time, and any explicit logout of / by the user would also invalidate the ticket. It would also not compromise the user on other systems where they potentially use the same password.
05-07-2019 08:57 AM
Thank you for your help.
Explore our Alfresco products with the links below. Use labels to filter content by product module.