Hashing and salting of passwords in Picketlink IDM

GateIn Portal is using Picketlink IDM framework to store information about identity objects (users/groups/memberships) and more info about this is in PicketLink IDM integration . For better security, Picketlink IDM does not save user passwords into database in plain-text, but it uses CredentialEncoder, which encode password and save the encoded form into Picketlink IDM database.
Later when user want to authenticate, he needs to provide his password in plain-text via web login form. Provided password is then encoded and compared with encoded password from Picketlink IDM database. GateIn Portal is then able to authenticate user based on this comparison.

Default implementation of CredentialEncoder is using password hashing with MD5 algorithm and storing those MD5 hashes in database. It does not use any salting of passwords. This is not safest solution, but it's backward compatible with previous releases of GateIn Portal before version 3.5, where MD5 password hashing was only possible encoding form. So if you migrate from older release of GateIn Portal, your users will be still able to authenticate.

However if you are starting from fresh database (no migration from previous GateIn Portal release), you may increase security by using better hashing algorithm and especially by enable password salting. See below for details.

<option>
  <name>credentialEncoder.class</name>
  <value>org.picketlink.idm.impl.credential.HashingEncoder</value>
</option>
<option>
  <name>credentialEncoder.hashAlgorithm</name>
  <value>MD5</value>
</option>

<option>
  <name>credentialEncoder.class</name>
  <value>org.picketlink.idm.impl.credential.DatabaseReadingSaltEncoder</value>
</option>
<option>
  <name>credentialEncoder.hashAlgorithm</name>
  <value>SHA-256</value>
</option>
<option>
  <name>credentialEncoder.secureRandomAlgorithm</name>
  <value>SHA1PRNG</value>
</option>

<option>
  <name>credentialEncoder.class</name>
  <value>org.picketlink.idm.impl.credential.FileReadingSaltEncoder</value>
</option>
<option>
  <name>credentialEncoder.hashAlgorithm</name>
  <value>SHA-256</value>
</option>
<option>
  <name>credentialEncoder.fileLocation</name>
  <value>/salt/mysalt.txt</value>
</option>

Password encryption of rememberme passwords

Administrators have two options available to ameliorate this risk:

1. The Remember Me feature can be disabled by removing the corresponding checkbox in:

   • JBOSS_HOME/gatein/gatein.ear/portal.war/login/jsp/login.jsp and

   • JBOSS_HOME/gatein/gatein.ear/portal.war/groovy/portal/webui/UILoginForm.gtmpl

2. Passwords can be encoded prior to being saved to the JCR. This option requires administrators to provide a custom subclass of org.exoplatform.web.security.security.AbstractCodec and set up a codec implementation with CookieTokenService:

3. Create a Java class similar to:

   package org.example.codec;
   
   import org.exoplatform.container.xml.InitParams;
   import org.exoplatform.web.security.security.AbstractCodec;
   import org.exoplatform.web.security.security.CookieTokenService;
   import org.picocontainer.Startable;
   
   public class ExampleCodec extends AbstractCodec implements Startable
   {
      private String simpleParam;
      private CookieTokenService cookieTokenService;
   
      public ExampleCodec(InitParams params, CookieTokenService cookieTokenService)
      {
         simpleParam = params.getValueParam("encodingParam").getValue();
         this.cookieTokenService = cookieTokenService;
      }
   
      public void start()
      {
         cookieTokenService.setupCodec(this);
      }
   
      public void stop()
      {
      }
   
      /**
       * Very simple encoding algorithm used only for demonstration purposes.
       * You should use stronger algorithm in real production environment!!!
       */
      public String encode(String plainInput)
      {
         return plainInput + simpleParam;
      }
   
      public String decode(String encodedInput)
      {
         return encodedInput.substring(0, encodedInput.length() - simpleParam.length());
      }
   
   }

   ExampleCodec is using very simple encoding algorithm used only for demonstration purposes. You should use stronger algorithm in real production environment!!!

4. Compile the class and package it into a .jar file. For this example, you will call the codec-example.jar file.

5. Create a conf/portal/configuration.xml file within the codec-example.jar similar to the example below. This allows the portal kernel to find and use the new codec implementation.

   <?xml version="1.0" encoding="ISO-8859-1"?>
   <configuration xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
   xsi:schemaLocation="http://www.exoplaform.org/xml/ns/kernel_1_2.xsd http://www.exoplaform.org/xml/ns/kernel_1_2.xsd"
   xmlns="http://www.exoplaform.org/xml/ns/kernel_1_2.xsd">
   
   <component>
      <key>org.example.codec.ExampleCodec</key>
      <type>org.example.codec.ExampleCodec</type>
      <init-params>
         <value-param>
            <name>encodingParam</name>
            <value>aaa</value>
         </value-param>
      </init-params>
   </component>
   
   </configuration>

6. Deploy codec-example.jar into your JBOSS_HOME/modules/org/gatein/lib/main directory and update file module.xml of this directory (new jar needs to be added to AS7 modules)

7. Start (or restart) your GateIn Portal.
   Any passwords written to the JCR will now be encoded and not plain text.