Shiro - how to login with hashed password -
i using shiro secure application, , problem how login hashed password following scenarios:
1, automatically login user after click on activation email.
2, login via facebook, find user facebookid database, , try login in, have hashed passwrod, have ways decrypt hashed password.
this how encrypt password stored in database:
new sha256hash(password).tohex()
below login code.
subject currentuser = securityutils.getsubject(); if (!currentuser.isauthenticated()) { usernamepasswordtoken token = new usernamepasswordtoken(email, password, rememberme); currentuser.login(token); }
bear me if question weird, , in advance.
the purpose of hash function undecryptable. no, can not decrypted. achieve both goals can configure additional realms. 1 email activation, other oauth login.
for email activation can create temporary account, create random activation token , send email. user clicks activation link , application tries authenticate user token provided in http request:
string token = //get request subject.authenticate(new activationtoken(token));
activation realm checks whether token valid. , if valid removes token account , authenticates it.
as facebook realm can use secret obtained outh authentication step user info , if there no erros authenticate user.
Comments
Post a Comment