Spring Security
  1. Spring Security
  2. SEC-1905

DigestAuthenticationFilter documentation is misleading

    Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Minor Minor
    • Resolution: Fixed
    • Affects Version/s: 3.1.0
    • Fix Version/s: 3.1.2
    • Component/s: Docs and Website
    • Labels:
      None

      Description

      At http://static.springsource.org/spring-security/site/docs/3.1.x/reference/springsecurity-single.html#digest-processing-filter
      Section 10.2.1 states "The configured UserDetailsService is needed because DigestAuthenticationFilter must have direct access to the clear text password of a user. Digest Authentication will NOT work if you are using encoded passwords in your DAO"

      This is a bit misleading.

      The Password just needs to be hashed as MD5(username:realm:password) and then the filter must have the passwordAlreadEncoded attribute
      set to true. Care must be taken to ensure that the realm for the DigestAuthenticationEntryPoint is set to the same value that is used by the MD5 Hash.

      The hash can be easily found with
      String DigestAuthUtils.encodePasswordInA1Format(String username, String realm, String password)
      In the org.springframework.security.web.authentication.www package.

        Activity

        Hide
        Rob Winch added a comment -

        I have added a footnote that clarifies this point.

        Show
        Rob Winch added a comment - I have added a footnote that clarifies this point.

          People

          • Assignee:
            Rob Winch
            Reporter:
            Bruce
          • Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Time Tracking

              Estimated:
              Original Estimate - 1h
              1h
              Remaining:
              Time Spent - 40m Remaining Estimate - 20m
              20m
              Logged:
              Time Spent - 40m Remaining Estimate - 20m
              40m