Databases
StackOverflow2013
Postsdbo
POIs it possible to use container-managed authentication with password salting?
Body
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POIs it possible to use container-managed authentication with password salting?
    text
    copied!<p>I know how to set up vanilla container-managed security that uses form authentication and uses digested passwords (say, SHA-256). Something like this:</p> <h3>web.xml</h3> <pre><code>&lt;login-config&gt; &lt;auth-method&gt;FORM&lt;/auth-method&gt; &lt;realm-name&gt;jdbc&lt;/realm-name&gt; &lt;form-login-config&gt; &lt;form-login-page&gt;/login.jsf&lt;/form-login-page&gt; &lt;form-error-page&gt;/login-error.jsf&lt;/form-error-page&gt; &lt;/form-login-config&gt; &lt;/login-config&gt; </code></pre> <h3>login.xhtml</h3> <pre><code>&lt;form action="j_security_check"&gt; &lt;p&gt;&lt;label&gt; Username:&lt;br/&gt; &lt;input type="text" name="j_username" /&gt; &lt;/label&gt;&lt;/p&gt; &lt;p&gt;&lt;label&gt; Password:&lt;br/&gt; &lt;input type="password" name="j_password" /&gt; &lt;/label&gt;&lt;/p&gt; &lt;p&gt; &lt;button type="submit"&gt;Submit&lt;/button&gt; &lt;/p&gt; &lt;/form&gt; </code></pre> <p>Pretty darn simple - but what I'd <em>really</em> like to be able to do is salt the password with a global salt and the username. Yes, I am aware that <a href="https://stackoverflow.com/questions/536584/non-random-salt-for-password-hashes/536756#536756">this isn't <strong>ideal</strong></a> but right now, I'm just building a proof-of-concept.</p> <p>Can the container (GlassFish 3, in this case) do this for me, or do I have to <a href="https://stackoverflow.com/questions/1470591/basic-security-in-jsf/1484398#1484398">write my own login filter</a>? I've done it before (for J2EE applications) but my gut tells me that there's got to be a tighter way to do it now that I'm using Java EE 6.</p>
 

Querying!

 
Guidance
An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload