Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

## org.jasypt.springsecurity2.providers.encoding
Class PasswordEncoder

    Object
      org.jasypt.springsecurity2.providers.encoding.PasswordEncoder

All Implemented Interfaces:
  org.springframework.security.providers.encoding.PasswordEncoder

    public final class PasswordEncoder

extends Object
implements org.springframework.security.providers.encoding.PasswordEncoder

This class implements the Spring Security 2.x `org.springframework.security.providers.encoding.PasswordEncoder` interface, allowing Spring Security-enabled applications to use JASYPT for password encryption.

Objects of this class will internally hold either an object of type `org.jasypt.util.password.PasswordEncryptor` or an object of type `org.jasypt.digest.StringDigester` (only one of them), which should be set by respectively calling `setPasswordEncryptor(PasswordEncryptor)` or `setStringDigester(StringDigester)` after creation. If neither a `PasswordEncryptor` nor a `StringDigester` are set, a new `org.jasypt.util.password.BasicPasswordEncryptor` object is created and internally used.

Important: This implementation ignores any salt provided through the interface methods, as the internal Jasypt `PasswordEncryptor` or `StringDigester` objects normally use a random one. This means that salt can be safely passed as `null`.

Usage with a PasswordEncryptor

This class can be used like this from your Spring XML resource files:

      ...
      <!-- Your application may use the PasswordEncryptor in several places, -->
      <!-- like for example at new user sign-up.                             -->
      <bean id="jasyptPasswordEncryptor" class="org.jasypt.util.password.StrongPasswordEncryptor" />
      ...
      ...
      <!-- This Spring Security-friendly PasswordEncoder implementation will -->
      <!-- wrap the PasswordEncryptor instance so that it can be used from   -->
      <!-- the security framework.                                           -->
      <bean id="passwordEncoder" class="org.jasypt.spring.security2.PasswordEncoder">
        <property name="passwordEncryptor">
          <ref bean="jasyptPasswordEncryptor" />
        </property>
      </bean>
      ...
      ...
      <!-- Your DaoAuthenticationProvider will then use it like with any     -->
      <!-- other implementation of the PasswordEncoder interface.            -->
      <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
          <property name="userDetailsService" ref="userDetailsService"/>
          <property name="passwordEncoder">
            <ref bean="passwordEncoder" />
          </property>
      </bean>
      ...

Usage with a StringDigester

This class can be used like this from your Spring XML resource files:

      ...
      <!-- Your application may use the StringDigester in several places,    -->
      <!-- like for example at new user sign-up.                             -->
      <bean id="jasyptStringDigester" class="org.jasypt.digest.StandardStringDigester" >
        <property name="algorithm" value="SHA-1" />
        <property name="iterations" value="100000" />
      </bean>
      ...
      ...
      <!-- This Spring Security-friendly PasswordEncoder implementation will -->
      <!-- wrap the StringDigester instance so that it can be used from      -->
      <!-- the security framework.                                           -->
      <bean id="passwordEncoder" class="org.jasypt.spring.security2.PasswordEncoder">
        <property name="stringDigester">
          <ref bean="jasyptStringDigester" />
        </property>
      </bean>
      ...
      ...
      <!-- Your DaoAuthenticationProvider will then use it like with any     -->
      <!-- other implementation of the PasswordEncoder interface.            -->
      <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
          <property name="userDetailsService" ref="userDetailsService"/>
          <property name="passwordEncoder">
            <ref bean="passwordEncoder" />
          </property>
      </bean>
      ...

This class is thread-safe

Since:
  1.9.0 (existed as org.jasypt.spring.security2.PasswordEncoder since 1.5)
Author:
  Daniel Fernández

Constructor Summary
`PasswordEncoder()` Creates a new instance of `PasswordEncoder`

Method Summary
`String` | `encodePassword(String rawPass, Object salt)` Encodes a password.
`boolean` | `isPasswordValid(String encPass, String rawPass, Object salt)` Checks a password's validity.
`void` | `setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor)` Sets a password encryptor to be used.
`void` | `setStringDigester(org.jasypt.digest.StringDigester stringDigester)` Sets a string digester to be used.

Methods inherited from class Object
`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

Constructor Detail

### PasswordEncoder

    public PasswordEncoder()

  Creates a new instance of `PasswordEncoder`

Method Detail

### setPasswordEncryptor

    public void setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor)

  Sets a password encryptor to be used. Only one of `setPasswordEncryptor` or `setStringDigester` should be called. If both are, the last call will define which method will be used.

  Parameters:
    `passwordEncryptor` - the password encryptor instance to be used.

### setStringDigester

    public void setStringDigester(org.jasypt.digest.StringDigester stringDigester)

  Sets a string digester to be used. Only one of `setPasswordEncryptor` or `setStringDigester` should be called. If both are, the last call will define which method will be used.

  Parameters:
    `stringDigester` - the string digester instance to be used.

### encodePassword

    public String encodePassword(String rawPass,
                                 Object salt)

  Encodes a password. This implementation completely ignores salt, as jasypt's `PasswordEncryptor` and `StringDigester` normally use a random one. Thus, it can be safely passed as `null`.

  Specified by:
    `encodePassword` in interface `org.springframework.security.providers.encoding.PasswordEncoder`
  Parameters:
    `rawPass` - The password to be encoded.
    `salt` - The salt, which will be ignored. It can be null.

### isPasswordValid

    public boolean isPasswordValid(String encPass,
                                   String rawPass,
                                   Object salt)

  Checks a password's validity. This implementation completely ignores salt, as jasypt's `PasswordEncryptor` and `StringDigester` normally use a random one. Thus, it can be safely passed as `null`.

  Specified by:
    `isPasswordValid` in interface `org.springframework.security.providers.encoding.PasswordEncoder`
  Parameters:
    `encPass` - The encrypted password (digest) against which to check.
    `rawPass` - The password to be checked.
    `salt` - The salt, which will be ignored. It can be null.

Overview | Package | Class | Use | Tree | Deprecated | Index | Help
PREV CLASS NEXT CLASS | FRAMES NO FRAMES
SUMMARY: NESTED | FIELD | CONSTR | METHOD | DETAIL: FIELD | CONSTR | METHOD

Copyright © 2014 The JASYPT team. All Rights Reserved.