Spring Security Custom Authentication and Password Encoding -

is there tutorial out there or have pointers on how following spring-security?

task:

i need salt database authenticating username , use encrypt provided password (from login page) compare stored encrypted password (a.k.a. authenticate user).

additional information:

i use custom database structure. userdetails object created via custom userdetailsservice in turn uses custom daoprovider information database.

my security.xml file far:

<authentication-manager>     <authentication-provider user-service-ref="userdetailsservice">     </authentication-provider> </authentication-manager> 

now guess i'll need

        <password-encoder hash="sha" /> 

but else? how tell spring security use databaseprovided salt in order encode password?

---

edit:

i found this so post informatative not sufficient: if define salt source in xml used password encoder, so:

        <password-encoder ref="passwordencoder">                             <salt-source ref="saltsource"/>         </password-encoder> 

i'll have write custom saltsource use custom salt. that's not found inside userdetails object. so...

alternative 1:

can use custom implementation of userdetails might have salt property?

<beans:bean id="saltsource" class="path.to.mysaltsource"     p:userpropertytouse="salt"/> 

and

@service("userdetailsservice")  public class userdetailsserviceimpl implements userdetailsservice {     public userdetails loaduserbyusername(string username)             throws usernamenotfoundexception, dataaccessexception {          // ...         return builduserfromaccount(account);     }      @transactional(readonly = true)      userdetailsimpl builduserfromaccount(account account){          // ... build user object contains salt property } 

custom user class:

public class userdetailsimpl extends user{      // ...      private string salt;      public string getsalt() { return salt; }      public void setsalt(string salt) { this.salt = salt; } } 

security.xml:

<authentication-manager>     <authentication-provider user-service-ref="userdetailsservice">         <password-encoder hash="sha">                         <salt-source ref="saltsource"/>     </password-encoder>     </authentication-provider> </authentication-manager>  <beans:bean id="saltsource" class="org.springframework.security.authentication.dao.reflectionsaltsource" p:userpropertytouse="salt"/> 

alternative 2:

otherwise i'd have inject accountdao saltsource extract salt given username database.

but: how spring security call saltsource? saltsource.getsalt(userdetails)?

then i'd have make sure saltsource uses userdetails.accountname on accountdao retrieve salt.

---

edit2:

just learned approach is.. legacy.. :( guess i'll use standardpasswordencoder (which still have figure out how use exactly).

btw: implemented first option custom userdetails class extending user class , adding salt property passed saltsource userpropertytouse has been proposed in post mentioned in edit 1...

---

edit 3:

just got standardpasswordencoder working, i'll leave pointers here:

use standardpasswordencoder authentication:

<beans:bean id="encoder"      class="org.springframework.security.crypto.password.standardpasswordencoder"> </beans:bean>   <authentication-manager>     <authentication-provider user-service-ref="userdetailsservice">         <password-encoder ref="encoder" />              </authentication-provider> </authentication-manager> 

this requires spring-security-crypto module in version 3.1.0.rc? far know. couldn't find repository has 3.0. version (even though somewhere had versions listed included 3.0.6 , on). documentations talks spring security 3.1 figured, i'll go that.

when creating user (for me admin can that), use

        standardpasswordencoder encoder = new standardpasswordencoder();         string result = encoder.encode(password); 

and i'm done.

spring security randomly create salt , add password string before storing in database no salt column needed anymore.

one can provide global salt constructor argument (new standardpasswordencoder("12345");), didn't know how set security configuration retrieve value bean instead of supplying static string <constructor-arg name="secret" value "12345" />. don't know how needed anyway.

i'll mark answered, solved problem , no other comments or answers given:

edit 1 - alternative 1 answers original question

but had learn customized password salting legacy approach not needed in spring security 3.1 more, describe in

edit 3 left pointers on how use standardpasswordencoder automated salts stored password.