org.jasypt.springsecurity4.crypto.password

Class PasswordEncoder

Object

org.jasypt.springsecurity4.crypto.password.PasswordEncoder

All Implemented Interfaces:

org.springframework.security.crypto.password.PasswordEncoder

public final class PasswordEncoder
extends Object
implements org.springframework.security.crypto.password.PasswordEncoder

This class implements the Spring Security 4.x org.springframework.security.crypto.password.PasswordEncoder interface, allowing Spring Security-enabled applications to use JASYPT for password encryption.

Objects of this class will internally hold either an object of type org.jasypt.util.password.PasswordEncryptor or an object of type org.jasypt.digest.StringDigester (only one of them), which should be set by respectively calling setPasswordEncryptor(PasswordEncryptor) or setStringDigester(StringDigester) after creation. If neither a PasswordEncryptor nor a StringDigester are set, a new org.jasypt.util.password.BasicPasswordEncryptor object is created and internally used.

Usage with a PasswordEncryptor

This class can be used like this from your Spring XML resource files:

  ...
  <!-- Your application may use the PasswordEncryptor in several places, --> 
  <!-- like for example at new user sign-up.                             --> 
  <bean id="jasyptPasswordEncryptor" class="org.jasypt.util.password.StrongPasswordEncryptor" />
  ...
  ...
  <!-- This Spring Security-friendly PasswordEncoder implementation will -->
  <!-- wrap the PasswordEncryptor instance so that it can be used from   -->
  <!-- the security framework.                                           -->
  <bean id="passwordEncoder" class="org.jasypt.springsecurity4.springsecurity4.crypto.password.PasswordEncoder">
    <property name="passwordEncryptor">
      <ref bean="jasyptPasswordEncryptor" />
    </property>
  </bean>
  ...
  ...
  <!-- Your DaoAuthenticationProvider will then use it like with any     -->
  <!-- other implementation of the PasswordEncoder interface.            -->
  <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
      <property name="userDetailsService" ref="userDetailsService"/>
      <property name="passwordEncoder">
        <ref bean="passwordEncoder" />
      </property>
  </bean>
  ...
 

Usage with a StringDigester

This class can be used like this from your Spring XML resource files:

  ...
  <!-- Your application may use the StringDigester in several places,    --> 
  <!-- like for example at new user sign-up.                             --> 
  <bean id="jasyptStringDigester" class="org.jasypt.digest.StandardStringDigester" >
    <property name="algorithm" value="SHA-1" />
    <property name="iterations" value="100000" />
  </bean>
  ...
  ...
  <!-- This Spring Security-friendly PasswordEncoder implementation will -->
  <!-- wrap the StringDigester instance so that it can be used from      -->
  <!-- the security framework.                                           -->
  <bean id="passwordEncoder" class="org.jasypt.springsecurity4.crypto.password.PasswordEncoder">
    <property name="stringDigester">
      <ref bean="jasyptStringDigester" />
    </property>
  </bean>
  ...
  ...
  <!-- Your DaoAuthenticationProvider will then use it like with any     -->
  <!-- other implementation of the PasswordEncoder interface.            -->
  <bean id="daoAuthenticationProvider" class="org.springframework.security.authentication.dao.DaoAuthenticationProvider">
      <property name="userDetailsService" ref="userDetailsService"/>
      <property name="passwordEncoder">
        <ref bean="passwordEncoder" />
      </property>
  </bean>
  ...
 

This class is thread-safe

Since:

1.9.3

Author:

Hoki Torres

Constructor Summary

Constructors

Constructor and Description
PasswordEncoder() Creates a new instance of PasswordEncoder

Method Summary

Modifier and Type	Method and Description
String	encode(CharSequence rawPassword) Encodes a password.
boolean	matches(CharSequence rawPassword, String encodedPassword) Checks a password's validity.
void	setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor) Sets a password encryptor to be used.
void	setStringDigester(org.jasypt.digest.StringDigester stringDigester) Sets a string digester to be used.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

PasswordEncoder

public PasswordEncoder()

Creates a new instance of PasswordEncoder

Method Detail

setPasswordEncryptor

public void setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor)

Sets a password encryptor to be used. Only one of setPasswordEncryptor or setStringDigester should be called. If both are, the last call will define which method will be used.

Parameters:

passwordEncryptor - the password encryptor instance to be used.

setStringDigester

public void setStringDigester(org.jasypt.digest.StringDigester stringDigester)

Sets a string digester to be used. Only one of setPasswordEncryptor or setStringDigester should be called. If both are, the last call will define which method will be used.

Parameters:

stringDigester - the string digester instance to be used.

encode

public String encode(CharSequence rawPassword)

Encodes a password.

Specified by:

encode in interface org.springframework.security.crypto.password.PasswordEncoder

Parameters:

rawPassword - The password to be encoded.

matches

public boolean matches(CharSequence rawPassword,
                       String encodedPassword)

Checks a password's validity.

Specified by:

matches in interface org.springframework.security.crypto.password.PasswordEncoder

Parameters:

encodedPassword - The encrypted password (digest) against which to check.

rawPassword - The password to be checked.