In the previous authentication mechanisms, the client sends the user credentials and the container validates.
The client doesn't attempt to encrypt the password.
So, our application is still not safe and is vulnerable to attacks.
This section is about passing an encrypted user credential to the server and telling the server which encryption algorithm can be used to decrypt the data.
JBoss is the application server that I have chosen to demonstrate it.
Modify
Login-config.xml
Create
encrypt-users. properties
Create
encrypt-roles. properties
<login-config> <auth-method>DIGEST</auth-method> <realm-name>PACKTSecurity</realm-name> </login-config>
Now, modify the
jboss-web.xml
file. The realm name is used for hashing:<?xml version="1.0" encoding="UTF-8"?> <!-- <jboss-web> --> <!-- <security-domain>java:/jaas/other</security-domain> --> <!-- </jboss-web> --> <jboss-web> <security-domain>java:/jaas/encryptme</security-domain> </jboss-web>
Modify the
login-config.xml
file<application-policy name="encryptme"> <!--this is used to demonstrate DIGEST Authentication --> <authentication> <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule" flag="required"/> <module-option name="usersProperties">encrypt-users.properties</module-option> <module-option name="rolesProperties">encrypt-roles.properties</module-option> <module-option name="hashAlgorithm">MD5</module-option> <module-option name="hashEncoding">rfc2617</module-option> <module-option name="hashUserPassword">false</module-option> <module-option name="hashStorePassword">true</module-option> <module-option name="passwordIsA1Hash">true</module-option> <module-option name="storeDigestCallback"> org.jboss.security.auth.spi.RFC2617Digest </module-option> </authentication> </application-policy>
Now, we need to tell JBoss to encrypt the user's password. To do that perform the following steps:
Go to
E:\JBOSS5.1\jboss-5.1.0.GA\common\lib
Go to the folder where JBoss is installed. I have installed JBoss on my
E:
Now on the command line, write
cd E:\JBOSS5.1\jboss-5.1.0.GA>
And then paste the following command:
java -cp client/jboss-logging-spi.jar;common/lib/jbosssx-server.jar org.jboss.security.auth.spi.RFC2617Digest anjana "PACKTSecurity" role1
Now edit
Encrypt-users. properties
:anjana=e3b6b01ec4b0bdd3fc1ff24d0ccabf1f
Encrypt roles and update
roles.properties
The previous example demonstrates the digest authentication mechanism. The password given in the J2EE container is encrypted using the MD5 algorithm. The container decrypts it and verifies the user credentials against the decrypted password. The authentication mechanism is digest
and the container pops up a login dialog box for the digest mechanism similar to the basic authentication mechanism.
The following screenshot shows the workflow:
It behaves like basic authentication, but uses the encrypted password along with the realm name to decrypt.