How to create Elytron DB realm user credentials

[tstiemerling]

The Picketlink APIs allow you to add the user and credentials to the DB realm when creating a new user. Is there something similar in Elytron (for the password) or do you manually have to create the password hash based on the selected algorithm?

[mchoma]

Could you paste the API example?

Elytron use concept of modifiable security realms, but jdbc-realm is not one of them. So I doubt so.

[tstiemerling]

This is the PicketLink code we use to create the DB users:

Realm realm = partitionManager.getPartition(Realm.class, IdentityManagementConfiguration.DB_PARTITION);

IdentityManager identityManager = partitionManager.createIdentityManager(realm);

User user = new User(username);

identityManager.add(user);

identityManager.updateCredential(user, new Password(password));

to replace this in Elytron we basically need to know how to create the password hash to put in the DB (we are using bcrypt).

Thanks.

[tstiemerling]

ok, it looks like the required code to create hashed password is here:

wildfly-elytron/BCryptPasswordTest.java at master · wildfly-security/wildfly-elytron · GitHub

When creating the bcrypt password mapper, does the salt and iterations have to come from the database, or can they be set as constant values in standalone.xml?

[tstiemerling]

Example code for anyone else who needs to do this:

byte[] salt = PasswordUtil.generateRandomSalt(BCRYPT_SALT_SIZE);

PasswordFactory factory = PasswordFactory.getInstance(ALGORITHM_BCRYPT);

BCryptPassword bcrypt = (BCryptPassword) factory.generatePassword(new EncryptablePasswordSpec(

password.toCharArray(), new IteratedSaltedPasswordAlgorithmSpec(DEFAULT_ITERATION_COUNT, salt)));

You then have to store the hash, salt and iterations in the user DB.