Search code examples
javaspringspring-securitysalt-cryptography

Spring security password hash + salt

I am working with a legacy application that stored passwords in plaintext. I have ported the application to spring 3 mvc + security. I have also successfully gotten spring security handling the authentication and authorization using sha256 + a salt based on the username. This all works great, however as part of the deployment, I will need to migrate the existing database to use the new password schema. I am not sure how spring security does it's password hashing with a salt, so i am unable to write a sql script that can be used to migrate the old plaintext passwords to the new sha256+salt schema. Is there any documentation or resources that I can use to figure this out?

Solution

  • This is documented in BasePasswordEncoder:

    The generated password will be in the form of password{salt}.

    So in your case you can compute the salted password using this simple code:

    new ShaPasswordEncoder(256).encodePassword(oldPassword, randomSalt)

    Note: ShaPasswordEncoder extends BasePasswordEncoder.