robertogallea / jaas_relational_login

JAAS module for authenticating against a relational dbms

Hi there 👋

My name is Roberto Gallea, I live in Italy and I am passionate about applying technology to many fields, such as multimedia, electronics, computer vision, woodworking and digital arts.

I am currently employed at the University of Palermo, Italy.

Language/Runtime : PHP, Python, Java, R, C/C++, ...

Framework/Libraries : Laravel, Symfony, Vue.js, React.js, Livewire, Flask, Django

I contribute to the OS community with some repositories and by giving talks and writing blog posts on my website and medium.

List of my talks (Italian language):

• Test Driven Development con Laravel @laravelday2019
• Creazione di package Laravel @laravelday2019
• Applicazione "Modulitiche" @laravelday2020
• Laravel smart APIs: filtrare dinamicamente modelli @Laravel Italia Live
• Alexa Skill Development con Laravel @Laravel Italia Live
• Design Patterns: Head-first vs emergent @phpdaypug21
• Papà come nascono i Service Container? @laravelday2021

Follow me on:

• My website: https://www.robertogallea.com
• Linkedin: https://www.linkedin.com/in/robertogallea/
• Twitter: https://twitter.com/robgallea
• Medium: https://medium.com/@robgallea

jaas_relational_login's Issues

DBLogin hash Encoding

I have been using this module and recently spotted a problem with encoding of the £ symbol.
It turns out that I used the following code in my change password servlet

byte[] bytes = md.digest(input.getBytes("UTF-8"));

But yours uses the default encoding instead, which in my case for some reason was not "UTF-8" so it failed to agree on the result.
Would it be possible to pass the required encoding as an extra jaas property to the hash function?

Is this approach working with idp_version 3.3.2 ?

I have upgraded to IDP 3.3.2 (from 3.2.1) and the JAAS RDBMS login just stopped working.
We use very similar "tagish" based code. Would you be so kind and confirm if your code works with IDP 3.3.2 ?

2018-04-06 22:41:04,934 - INFO [net.shibboleth.idp.authn.impl.ValidateUsernamePasswordAgainstJAAS:254] - [...] - [...] - Profile Action ValidateUsernamePasswordAgainstJAAS: Login by '...' via 'ShibUserPassAuth' failed
javax.security.auth.login.LoginException: Error reading user database (net.sourceforge.jtds.jdbc.Driver)
at com.tagish.auth.DBLogin.validateUser(DBLogin.java:73)

won't build with Ivy 2.5

I tried to rebuild jaas_relational_login recently. ivy 2.3.0 generatings "http" urls for the dependencies instead of "https", as does ivy 2.4.0

So.. I tried updating to ivy 2.5.0, and while it downloads the dependencies in the lib directory, it doesn't use them when it tries to build the target jar:

compile:
   [echo] compiling...
   [javac] Compiling 6 source files to /home/liamr/git/jaas_relational_login/target/classes
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:14: error: package org.springframework.security.crypto.password does not exist
   [javac] import org.springframework.security.crypto.password.PasswordEncoder;
   [javac]                                                    ^
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:15: error: package org.springframework.security.crypto.bcrypt does not exist
   [javac] import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder;
   [javac]                                                  ^
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:16: error: package org.apache.commons.codec.digest does not exist
   [javac] import org.apache.commons.codec.digest.Md5Crypt;
   [javac]                                       ^
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:36: error: cannot find symbol
   [javac] 	private PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
   [javac] 	        ^
   [javac]   symbol:   class PasswordEncoder
   [javac]   location: class DBLogin
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:36: error: cannot find symbol
   [javac] 	private PasswordEncoder passwordEncoder = new BCryptPasswordEncoder();
   [javac] 	                                              ^
   [javac]   symbol:   class BCryptPasswordEncoder
   [javac]   location: class DBLogin
   [javac] /home/liamr/git/jaas_relational_login/src/relationalLogin/DBLogin.java:76: error: cannot find symbol
   [javac] 					if (!upwd.equals(Md5Crypt.md5Crypt(tpwd.getBytes(), upwd))) throw new FailedLoginException(getOption("errorMessage", "Invalid details"));
   [javac] 					                 ^
   [javac]   symbol:   variable Md5Crypt
   [javac]   location: class DBLogin
   [javac] Note: Some input files use unchecked or unsafe operations.
   [javac] Note: Recompile with -Xlint:unchecked for details.
   [javac] 6 errors

BUILD FAILED
/home/liamr/git/jaas_relational_login/build.xml:30: Compile failed; see the compiler error output for details.

Will build, gives nested exception when used

Good afternoon,

I have a need to change one of the Java files, DBLogin.jar, as I believe it is adding strings that are already present in the returned SQL.
I am trying to remove the line String upwd2 = "$2a" + upwd.substring(3); as my returned password hash already has the hash identifier prepended and it always returns "Invalid password"

so therefore I need to build this from source to test my theory unfortunately whenever I try and build it the resulting jar file gives a nested exception:

        at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:1086)
Caused by: java.lang.NoClassDefFoundError: org/springframework/security/crypto/password/PasswordEncoder
        at java.base/java.lang.Class.getDeclaredConstructors0(Native Method)
Caused by: java.lang.ClassNotFoundException: org.springframework.security.crypto.password.PasswordEncoder
        at java.base/jdk.internal.loader.BuiltinClassLoader.loadClass(BuiltinClassLoader.java:581)```

I have tried this with and without the line removal, so i must be not using the right syntax, i am just runnng `ant` in the root of the cloned repo. Could you perhaps tell me how this should be built? Java is not my language

Thanks
James