From 4529e09339aa44344da455373101a0eb735bdec0 Mon Sep 17 00:00:00 2001 From: Rob Winch Date: Sun, 22 Oct 2017 15:58:56 -0500 Subject: [PATCH] Remove PasswordEncoder from core Issue: gh-4674 --- .../AbstractDaoAuthenticationConfigurer.java | 17 ---- .../dao/DaoAuthenticationProvider.java | 51 ++--------- .../encoding/PasswordEncoder.java | 91 ------------------- .../authentication/encoding/package-info.java | 26 ------ .../dao/DaoAuthenticationProviderTests.java | 15 +-- 5 files changed, 9 insertions(+), 191 deletions(-) delete mode 100644 core/src/main/java/org/springframework/security/authentication/encoding/PasswordEncoder.java delete mode 100644 core/src/main/java/org/springframework/security/authentication/encoding/package-info.java diff --git a/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/userdetails/AbstractDaoAuthenticationConfigurer.java b/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/userdetails/AbstractDaoAuthenticationConfigurer.java index 806e002f68..d427e18c44 100644 --- a/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/userdetails/AbstractDaoAuthenticationConfigurer.java +++ b/config/src/main/java/org/springframework/security/config/annotation/authentication/configurers/userdetails/AbstractDaoAuthenticationConfigurer.java @@ -74,23 +74,6 @@ abstract class AbstractDaoAuthenticationConfigurer - * Encodes the specified raw password with an implementation specific algorithm. - *

- *

- * This will generally be a one-way message digest such as MD5 or SHA, but may also be - * a plaintext variant which does no encoding at all, but rather returns the same - * password it was fed. The latter is useful to plug in when the original password - * must be stored as-is. - *

- *

- * The specified salt will potentially be used by the implementation to "salt" the - * initial value before encoding. A salt is usually a user-specific value which is - * added to the password before the digest is computed. This means that computation of - * digests for common dictionary words will be different than those in the backend - * store, because the dictionary word digests will not reflect the addition of the - * salt. If a per-user salt is used (rather than a system-wide salt), it also means - * users with the same password will have different digest encoded passwords in the - * backend store. - *

- *

- * If a salt value is provided, the same salt value must be use when calling the - * {@link #isPasswordValid(String, String, Object)} method. Note that a specific - * implementation may choose to ignore the salt value (via null), or - * provide its own. - *

- * - * @param rawPass the password to encode - * @param salt optionally used by the implementation to "salt" the raw password before - * encoding. A null value is legal. - * - * @return encoded password - */ - String encodePassword(String rawPass, Object salt); - - /** - *

- * Validates a specified "raw" password against an encoded password. - *

- *

- * The encoded password should have previously been generated by - * {@link #encodePassword(String, Object)}. This method will encode the - * rawPass (using the optional salt), and then compared it - * with the presented encPass. - *

- *

- * For a discussion of salts, please refer to {@link #encodePassword(String, Object)}. - *

- * - * @param encPass a pre-encoded password - * @param rawPass a raw password to encode and compare against the pre-encoded - * password - * @param salt optionally used by the implementation to "salt" the raw password before - * encoding. A null value is legal. - * - * @return true if the password is valid , false otherwise - */ - boolean isPasswordValid(String encPass, String rawPass, Object salt); -} diff --git a/core/src/main/java/org/springframework/security/authentication/encoding/package-info.java b/core/src/main/java/org/springframework/security/authentication/encoding/package-info.java deleted file mode 100644 index 2aaad9204e..0000000000 --- a/core/src/main/java/org/springframework/security/authentication/encoding/package-info.java +++ /dev/null @@ -1,26 +0,0 @@ -/* - * Copyright 2002-2016 the original author or authors. - * - * Licensed under the Apache License, Version 2.0 (the "License"); - * you may not use this file except in compliance with the License. - * You may obtain a copy of the License at - * - * http://www.apache.org/licenses/LICENSE-2.0 - * - * Unless required by applicable law or agreed to in writing, software - * distributed under the License is distributed on an "AS IS" BASIS, - * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. - * See the License for the specific language governing permissions and - * limitations under the License. - */ -/** - * Password encoding implementations. Apart from the "null" implementations, they are all based on - * password hashing using digest functions. See the - * - * reference manual for more information. - *

- * Third part implementations such as those provided by Jasypt - * can also be used. - */ -package org.springframework.security.authentication.encoding; - diff --git a/core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java b/core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java index 6a8ff85880..bc360853af 100644 --- a/core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java +++ b/core/src/test/java/org/springframework/security/authentication/dao/DaoAuthenticationProviderTests.java @@ -390,9 +390,9 @@ public class DaoAuthenticationProviderTests { @Test public void testGettersSetters() { DaoAuthenticationProvider provider = new DaoAuthenticationProvider(); - provider.setPasswordEncoder(new PWE()); + provider.setPasswordEncoder(new BCryptPasswordEncoder()); assertThat(provider.getPasswordEncoder().getClass()).isEqualTo( - PWE.class); + BCryptPasswordEncoder.class); provider.setSaltSource(new SystemWideSaltSource()); assertThat(provider.getSaltSource().getClass()).isEqualTo( @@ -407,17 +407,6 @@ public class DaoAuthenticationProviderTests { assertThat(provider.isForcePrincipalAsString()).isTrue(); } - static class PWE implements org.springframework.security.authentication.encoding.PasswordEncoder { - @Override public String encodePassword(String rawPass, Object salt) { - return null; - } - - @Override public boolean isPasswordValid(String encPass, String rawPass, - Object salt) { - return false; - } - } - @Test public void testGoesBackToAuthenticationDaoToObtainLatestPasswordIfCachedPasswordSeemsIncorrect() { UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken(