1 Reply Latest reply on Apr 4, 2005 5:39 PM by Roland Brown

    Using password hashing in JAAS not working.  Password hash c

    Roland Brown Newbie

      Hi I am trying to use the Password Hashing mechanism described in the Dukes Bank tutorial.

      I was able to successfully get the regular login and password tied to a database security using JAAS to work.

      When I now try to use the Password Hashing I get the following error in the JBOSS log file.

      Password hash calculation failed
      java.security.NoSuchAlgorithmException: BASE64 MessageDigest not available.

      The instructions say to add the following two lines to the configuration. I could only assume this means the login-config.xml file.

      <module-option name="hashAlgorithm">MD5</module-option>
      <module-option name="hashEncoding">base64</module-option>
      


      The application-policy of my login-config.xml file now looks like the following.

       <application-policy name="webquotes">
       <authentication>
       <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
       <module-option name="dsJndiName">java:/webquotes</module-option>
       <module-option name="principalsQuery">
       select password from users where username=?
       </module-option>
       <module-option name="rolesQuery">
       select role,'Roles' from users where username=?
       </module-option>
       <module-option name="hashAlgorithm">MD5</module-option>
       <module-option name="hashAlgorithm">base64</module-option>
       </login-module>
       </authentication>
       </application-policy>
      



      Did I put the two lines in the wrong config file? In the wrong position? Is there a library I need to include? I was able to generate the hashcode with the

      java -classpath ./jbosssx.jar org.jboss.security.Base64Encoder j22ee MD5

      command.
      Any help would be appreciated.


        • 1. Found the problem.
          Roland Brown Newbie

          I did not make the entry the way I should have in the login.xml file. I made the following entry.

           <module-option name="hashAlgorithm">MD5</module-option>
           <module-option name="hashAlgorithm">base64</module-option>
          
          


          It should have been

           <module-option name="hashAlgorithm">MD5</module-option>
           <module-option name="hashEncoding">base64</module-option>
          
          


          That solved the problem.

          My application-policy in the login-config.xml file now looks like this.

           <application-policy name="webquotes">
           <authentication>
           <login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag="required">
           <module-option name="dsJndiName">java:/webquotes</module-option>
           <module-option name="hashAlgorithm">MD5</module-option>
           <module-option name="hashEncoding">base64</module-option>
           <module-option name="principalsQuery">
           select hashpasswd from users where username=?
           </module-option>
           <module-option name="rolesQuery">
           select role,'Roles' from users where username=?
           </module-option>
           </login-module>
           </authentication>
           </application-policy>