Hashing/Digest authentication on servlet

In the previous authentication mechanisms, the client sends the user credentials and the container validates.

The client doesn't attempt to encrypt the password.

So, our application is still not safe and is vulnerable to attacks.

This section is about passing an encrypted user credential to the server and telling the server which encryption algorithm can be used to decrypt the data.

JBoss is the application server that I have chosen to demonstrate it.

Getting ready

• Modify Login-config.xml
• Create encrypt-users. properties
• Create encrypt-roles. properties

How to do it....

1. Modify the web.xml file:

   <login-config>
       <auth-method>DIGEST</auth-method>
       <realm-name>PACKTSecurity</realm-name>
   </login-config>

2. Now, modify the jboss-web.xml file. The realm name is used for hashing:

   <?xml version="1.0" encoding="UTF-8"?>
   <!-- <jboss-web> -->
   <!-- <security-domain>java:/jaas/other</security-domain> -->
   <!-- </jboss-web> -->
   <jboss-web>
   <security-domain>java:/jaas/encryptme</security-domain>
   </jboss-web>

3. Modify the login-config.xml file

   <application-policy name="encryptme">
       <!--this is used to demonstrate DIGEST Authentication
       -->
       <authentication>
         <login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
           flag="required"/>
       <module-option name="usersProperties">encrypt-users.properties</module-option>
       <module-option name="rolesProperties">encrypt-roles.properties</module-option>
       <module-option name="hashAlgorithm">MD5</module-option>
       <module-option name="hashEncoding">rfc2617</module-option>
       <module-option name="hashUserPassword">false</module-option>
       <module-option name="hashStorePassword">true</module-option>
       <module-option name="passwordIsA1Hash">true</module-option>
      <module-option name="storeDigestCallback">
                   org.jboss.security.auth.spi.RFC2617Digest
       </module-option>	
       </authentication>
     </application-policy>

4. Now, we need to tell JBoss to encrypt the user's password. To do that perform the following steps:
   • Go to E:\JBOSS5.1\jboss-5.1.0.GA\common\lib
   • Open jbosssx-server.jar
   • Go to the folder where JBoss is installed. I have installed JBoss on my E:
   • Now on the command line, write cd E:\JBOSS5.1\jboss-5.1.0.GA>
   • And then paste the following command: java -cp client/jboss-logging-spi.jar;common/lib/jbosssx-server.jar org.jboss.security.auth.spi.RFC2617Digest anjana "PACKTSecurity" role1
     
   • Now edit Encrypt-users. properties:

     anjana=e3b6b01ec4b0bdd3fc1ff24d0ccabf1f

   • Encrypt roles and update roles.properties

How it works...

The previous example demonstrates the digest authentication mechanism. The password given in the J2EE container is encrypted using the MD5 algorithm. The container decrypts it and verifies the user credentials against the decrypted password. The authentication mechanism is digest and the container pops up a login dialog box for the digest mechanism similar to the basic authentication mechanism.

The following screenshot shows the workflow:

It behaves like basic authentication, but uses the encrypted password along with the realm name to decrypt.

See also

• The Basic authentication for JAX-WS and JAX-RS recipe
• The Enabling and disabling the file listing recipe