can't login with Arabic password using JAAS in JBoss AS

[romyo0o]

Hello,

The problem is that I can't login to my application with Arabic password although I can login with english password and i'm using the following:

First:(Base64)

Hashing password before insert it into the DB using below code:

 private String getSha1(String text) throws NoSuchAlgorithmException,
   UnsupportedEncodingException {
  MessageDigest md;
  md = MessageDigest.getInstance("SHA-1");
  byte[] sha1hash = new byte[40];
  md.update(text.getBytes("UTF-8"), 0, text.length());
  sha1hash = md.digest();
  return convertToBase64(sha1hash);
 }

 private String convertToBase64(byte[] data) {
  return new String(Base64.encode(data, data.length));
 }

Second:login-config.xml

adding policy in the login file and add the orange lines below to support hashing password before selecting it from the DB:

 <application-policy name="messageEnginge">
          <authentication>
          <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
          <module-option name="unauthenticatedIdentity">guest</module-option>
          <module-option name="dsJndiName">jndiname</module-option>
          <module-option name="principalsQuery">the query of password   </module-option>
          <module-option name="rolesQuery">thequery of roles        </module-option>
 
 
              <module-option name="hashCharset">UTF-8</module-option>
          <module-option name="hashAlgorithm">SHA1</module-option>
          <module-option name="hashEncoding">base64</module-option>
    
          </login-module>
          </authentication>
   </application-policy>

Jboss AS version > 5.0

using JSF and richfaces for info

Also the image below shows the request of login action:

[sfcoy]

Have you taken steps to ensure that your webapp requests/responses are encoded in UTF-8?

We use a servlet filter for this purpose.

[romyo0o]

Thanks,

I added a filter and nothing work, the j_secutiry_check request doesn't pass on the filter

[romyo0o]

I added the request post method snapshot

[sfcoy]

I was afraid that might happen. Servlet filters seem to work for j_security_check on some app servers and not others.

In any event, you might try adding the following to your login form (assuming it's a JSP):

{code:xml}<%@ page contentType="text/html; charset=UTF-8" %>
...
     <%
       request.setCharacterEncoding("UTF-8");
     %>
...{code}

[romyo0o]

Thanks Stephen,

but the same issue and the same request snapshot as above, the password in the request in UTF-8 format

already my form accept utf-8:

<form action="<%= response.encodeURL( "j_security_check" ) %>" method="post" accept-charset="UTF-8">

I think the problem now is not in the encoding of the request ?

[sfcoy]

Sorry, it's the response encoding that we really need to be concerned about. The above was an attempt to encourage the browser to respond in UTF-8. Using accept-charset is a better idea.

At this point I'd be loading up the source code for your version of JBoss and debugging it.

[romyo0o]

Thanks

Hope  any feed back

[romyo0o]

I didn't find a solution till now, so I did a workaround to ignored arabic passwords.

[danpeter]

Maybe this is similar to my issue:
http://stackoverflow.com/questions/12676336/jaas-autentication-fails-on-jboss-as-7

[ybxiang.china]

Answer in http://stackoverflow.com/questions/12676336/jaas-autentication-fails-on-jboss-as-7 works well in jboss as 7.2.0

<?xml version="1.0" encoding="UTF-8"?>
<jboss-web>
    <security-domain>MySecurityDomain</security-domain>
    <valve>
        <class-name>org.apache.catalina.authenticator.FormAuthenticator</class-name>
        <param>
            <param-name>characterEncoding</param-name>
            <param-value>UTF-8</param-value>
        </param>
    </valve>
</jboss-web>