2 Replies Latest reply on Mar 18, 2011 4:37 AM by su baochen

    md5 password hash problem

    su baochen Newbie
      Hi all,

      I have a legency database with pure md5 password(not using salt), so I extended JpaIdentityStore like this:



      `
      @Name("myJpaIdentityStore")
      @Scope(ScopeType.APPLICATION)
      //@BypassInterceptors
      //@Install(precedence = BUILT_IN, value=false)
      public class MyJpaIdentityStore extends JpaIdentityStore {

              @Override
              protected String getUserAccountSalt(Object user) {
                      return "";
              }
      }`





      and part of my components.xml:


      `
      <security:identity-manager identity-store="#{myJpaIdentityStore}" />

         <security:jpa-identity-store
            user-class="com.mycompany.model.Member"
            role-class="com.mycompany.model.Role"/>

         <security:jpa-permission-store user-permission-class="com.mycompany.model.Permission"/>`




      Below is part of Member class:
      `
              @Column(name = "username", unique = true, length = 50)
              @Length(max = 50)
              @UserPrincipal
              public String getUsername() {
                      return this.username;
              }

              public void setUsername(String username) {
                      this.username = username;
              }

              @Column(name = "password")
              @UserPassword(hash="MD5")
              public String getPassword() {
                      return this.password;
              }

              public void setPassword(String password) {
                      this.password = password;
              }`

      But when I try to login, server.log tell me:




      `
      2011-03-17 12:00:20,005 DEBUG [org.jboss.seam.security.Identity] (http-127.0.0.1-8080-2) Login failed for: admin
      javax.security.auth.login.LoginException
              at org.jboss.seam.security.jaas.SeamLoginModule.login(SeamLoginModule.java:143)
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
              at java.lang.reflect.Method.invoke(Method.java:597)
              at javax.security.auth.login.LoginContext.invoke(LoginContext.java:769)
              at javax.security.auth.login.LoginContext.access$000(LoginContext.java:186)
              at javax.security.auth.login.LoginContext$5.run(LoginContext.java:706)
              at java.security.AccessController.doPrivileged(Native Method)
              at javax.security.auth.login.LoginContext.invokeCreatorPriv(LoginContext.java:703)
              at javax.security.auth.login.LoginContext.login(LoginContext.java:575)
              at org.jboss.seam.security.Identity.authenticate(Identity.java:344)
              at org.jboss.seam.security.Identity.authenticate(Identity.java:332)
              at org.jboss.seam.security.Identity.login(Identity.java:259)
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
              at java.lang.reflect.Method.invoke(Method.java:597)
              at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:335)
              at org.jboss.el.util.ReflectionUtil.invokeMethod(ReflectionUtil.java:348)
              at org.jboss.el.parser.AstPropertySuffix.invoke(AstPropertySuffix.java:58)
              at org.jboss.el.parser.AstValue.invoke(AstValue.java:96)
              at org.jboss.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:276)
              at com.sun.facelets.el.TagMethodExpression.invoke(TagMethodExpression.java:68)
              at javax.faces.component.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.java:88)
              at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
              at javax.faces.component.UICommand.broadcast(UICommand.java:387)
              at org.ajax4jsf.component.AjaxViewRoot.processEvents(AjaxViewRoot.java:329)
              at org.ajax4jsf.component.AjaxViewRoot.broadcastEventsForPhase(AjaxViewRoot.java:304)
              at org.ajax4jsf.component.AjaxViewRoot.processPhase(AjaxViewRoot.java:261)
              at org.ajax4jsf.component.AjaxViewRoot.processApplication(AjaxViewRoot.java:474)
              at com.sun.faces.lifecycle.InvokeApplicationPhase.execute(InvokeApplicationPhase.java:82)
              at com.sun.faces.lifecycle.Phase.doPhase(Phase.java:100)
              at com.sun.faces.lifecycle.LifecycleImpl.execute(LifecycleImpl.java:118)
              at javax.faces.webapp.FacesServlet.service(FacesServlet.java:265)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:290)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.tuckey.web.filters.urlrewrite.RuleChain.handleRewrite(RuleChain.java:164)
              at org.tuckey.web.filters.urlrewrite.RuleChain.doRules(RuleChain.java:141)
              at org.tuckey.web.filters.urlrewrite.UrlRewriter.processRequest(UrlRewriter.java:90)
              at org.tuckey.web.filters.urlrewrite.UrlRewriteFilter.doFilter(UrlRewriteFilter.java:406)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:83)
              at org.jboss.seam.web.IdentityFilter.doFilter(IdentityFilter.java:40)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.jboss.seam.web.MultipartFilter.doFilter(MultipartFilter.java:90)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.jboss.seam.web.ExceptionFilter.doFilter(ExceptionFilter.java:64)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.jboss.seam.web.RedirectFilter.doFilter(RedirectFilter.java:45)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.ajax4jsf.webapp.BaseXMLFilter.doXmlFilter(BaseXMLFilter.java:206)
              at org.ajax4jsf.webapp.BaseFilter.handleRequest(BaseFilter.java:290)
              at org.ajax4jsf.webapp.BaseFilter.processUploadsAndHandleRequest(BaseFilter.java:388)
              at org.ajax4jsf.webapp.BaseFilter.doFilter(BaseFilter.java:515)
              at org.jboss.seam.web.Ajax4jsfFilter.doFilter(Ajax4jsfFilter.java:56)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.jboss.seam.web.LoggingFilter.doFilter(LoggingFilter.java:60)
              at org.jboss.seam.servlet.SeamFilter$FilterChainImpl.doFilter(SeamFilter.java:69)
              at org.jboss.seam.servlet.SeamFilter.doFilter(SeamFilter.java:158)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at cn.luthai.misc.P3PFilter.doFilter(P3PFilter.java:36)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
              at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
              at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
              at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:235)
              at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:191)
              at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:190)
              at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:433)
              at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:92)
              at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.process(SecurityContextEstablishmentValve.java:126)
              at org.jboss.web.tomcat.security.SecurityContextEstablishmentValve.invoke(SecurityContextEstablishmentValve.java:70)
              at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
              at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
              at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:158)
              at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
              at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:330)
              at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:828)
              at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:601)
              at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:447)
              at java.lang.Thread.run(Thread.java:662)
      Caused by: java.lang.NullPointerException
              at org.jboss.seam.security.management.JpaIdentityStore.lookupUser(JpaIdentityStore.java:860)
              at com.mallng.security.MyJpaIdentityStore.lookupUser(MyJpaIdentityStore.java:50001)
              at org.jboss.seam.security.management.JpaIdentityStore.authenticate(JpaIdentityStore.java:806)
              at com.mallng.security.MyJpaIdentityStore.authenticate(MyJpaIdentityStore.java:50001)
              at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
              at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
              at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
              at java.lang.reflect.Method.invoke(Method.java:597)
              at org.jboss.seam.util.Reflections.invoke(Reflections.java:22)
              at org.jboss.seam.intercept.RootInvocationContext.proceed(RootInvocationContext.java:32)
              at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:56)
              at org.jboss.seam.transaction.RollbackInterceptor.aroundInvoke(RollbackInterceptor.java:28)
              at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68)
              at org.jboss.seam.core.MethodContextInterceptor.aroundInvoke(MethodContextInterceptor.java:44)
              at org.jboss.seam.intercept.SeamInvocationContext.proceed(SeamInvocationContext.java:68)
              at org.jboss.seam.intercept.RootInterceptor.invoke(RootInterceptor.java:107)
              at org.jboss.seam.intercept.JavaBeanInterceptor.interceptInvocation(JavaBeanInterceptor.java:185)
              at org.jboss.seam.intercept.JavaBeanInterceptor.invoke(JavaBeanInterceptor.java:103)
              at com.mallng.security.MyJpaIdentityStore_$$_javassist_seam_16.authenticate(MyJpaIdentityStore_$$_javassist_seam_16.java)
              at org.jboss.seam.security.management.IdentityManager.authenticate(IdentityManager.java:271)
              at org.jboss.seam.security.jaas.SeamLoginModule.login(SeamLoginModule.java:128)
      `






      I have checked the source of JpaIdentityStore, but can not understand why looupUser method failed with NPE?

      Any help is very appreciated, thanks in advance!

      Baochen
        • 1. Re: md5 password hash problem
          su baochen Newbie

          Sorry, I can not find how to edit the post to format the code, anyone also kindly point out this?


          To clarify, I have comment out:





          //@BypassInterceptors
          //@Install(precedence = BUILT_IN, value=false)







          in MyJpaIdentityStore, otherwise seam can not initialize the component myJpaIdentityStore, but I don't know why: why add @BypassInterceptors and @Install annotation result in failed to initialize the component?


          Thanks in advance!

          • 2. Re: md5 password hash problem
            su baochen Newbie

            Maybe I have got the answer: JpaIdentityStore is not suitable to extend,right? Because in JpaIdentityStore, entityManager is a private variable, and so many private variable.... so when extended from JpaIdentityStore, youJpaIdentityStore.lookupUser will failed because entityManager is null.