Search code examples
securitytomcatjdbcrealm

Is there existing support in tomcat for a JDBCRealm that takes in a salt?

We are currently using tomcat 5.5 and would like to add a salt to our JDBCRealm authentication. I was wondering if there was any existing classes or do we need to extend JDBCRealm and write our own authentication class?

We have the following in our server.xml

<Realm className="org.apache.catalina.realm.JDBCRealm" ...more stuff… />

But it does not look like this class takes in a salt.

Solution
    1. Write your own JDBCRealmWithSalt class that extends JDBCRealm class
    2. Overwrite digest() method (add your salt here)
    3. Put JDBCRealmWithSalt in catalina.jar:org/apache/catalina/realm
    4. <Realm className="org.apache.catalina.realm.JDBCRealmWithSalt"...>