Skip to content

Commit

Permalink
Added support for new Argon2PasswordEncoder (#902)
Browse files Browse the repository at this point in the history
  • Loading branch information
@hayeskl
hayeskl authored Aug 14, 2023
1 parent 99dca1b commit 48398c2
Showing 1 changed file with 28 additions and 25 deletions.
53 changes: 28 additions & 25 deletions plugin/src/main/groovy/grails/plugin/springsecurity/SpringSecurityCoreGrailsPlugin.groovy
View file
Original file line number Diff line number Diff line change
Expand Up @@ -81,6 +81,7 @@ import org.springframework.security.core.context.SecurityContextHolder as SCH
import org.springframework.security.core.userdetails.UserDetailsByNameServiceWrapper
import org.springframework.security.core.userdetails.cache.EhCacheBasedUserCache
import org.springframework.security.core.userdetails.cache.NullUserCache
import org.springframework.security.crypto.argon2.Argon2PasswordEncoder
import org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder
import org.springframework.security.crypto.password.DelegatingPasswordEncoder
import org.springframework.security.crypto.password.LdapShaPasswordEncoder
Expand Down Expand Up @@ -145,6 +146,7 @@ class SpringSecurityCoreGrailsPlugin extends Plugin {
public static final String ENCODING_ID_NOOP = "noop"
public static final String ENCODING_ID_PBKDF2 = "pbkdf2"
public static final String ENCODING_ID_SCRYPT = "scrypt"
public static final String ENCODING_ID_ARGON2 = "argon2"
public static final String ENCODING_ID_SHA1 = "SHA-1"
public static final String ENCODING_IDSHA256 = "SHA-256"

Expand Down Expand Up @@ -412,8 +414,8 @@ class SpringSecurityCoreGrailsPlugin extends Plugin {
String securityConfigType = SpringSecurityUtils.securityConfigType
log.trace "Using security config type '{}'", securityConfigType
if (securityConfigType != 'Annotation' &&
securityConfigType != 'Requestmap' &&
securityConfigType != 'InterceptUrlMap') {
securityConfigType != 'Requestmap' &&
securityConfigType != 'InterceptUrlMap') {

String message = """
ERROR: the 'securityConfigType' property must be one of
Expand Down Expand Up @@ -513,7 +515,7 @@ to default to 'Annotation'; setting value to 'Annotation'

authenticationEventPublisher(classFor('authenticationEventPublisher', DefaultAuthenticationEventPublisher)) {
additionalExceptionMappings =
([(NoStackUsernameNotFoundException.name): AuthenticationFailureBadCredentialsEvent.name] as Properties)
([(NoStackUsernameNotFoundException.name): AuthenticationFailureBadCredentialsEvent.name] as Properties)
}
}
else {
Expand Down Expand Up @@ -703,7 +705,7 @@ to default to 'Annotation'; setting value to 'Annotation'

// build handlers list here to give dependent plugins a chance to register some
def logoutHandlerNames = (conf.logout.handlerNames ?: SpringSecurityUtils.logoutHandlerNames) +
(conf.logout.additionalHandlerNames ?: [])
(conf.logout.additionalHandlerNames ?: [])
applicationContext.logoutHandlers.clear()
applicationContext.logoutHandlers.addAll createBeanList(logoutHandlerNames)
log.trace 'LogoutHandlers: {}', applicationContext.logoutHandlers
Expand Down Expand Up @@ -766,8 +768,8 @@ to default to 'Annotation'; setting value to 'Annotation'
private void initializeFromAnnotations(conf) {
AnnotationFilterInvocationDefinition afid = applicationContext.objectDefinitionSource
afid.initialize conf.controllerAnnotations.staticRules,
applicationContext.grailsUrlMappingsHolder, grailsApplication.controllerClasses,
grailsApplication.domainClasses
applicationContext.grailsUrlMappingsHolder, grailsApplication.controllerClasses,
grailsApplication.domainClasses
}

private createRefList = { names -> names.collect { name -> ref(name) } }
Expand Down Expand Up @@ -1100,30 +1102,31 @@ to default to 'Annotation'; setting value to 'Annotation'
}


Map<String, PasswordEncoder> idToPasswordEncoder(ConfigObject conf) {
static Map<String, PasswordEncoder> idToPasswordEncoder(ConfigObject conf) {

MessageDigestPasswordEncoder messsageDigestPasswordEncoderMD5 = new MessageDigestPasswordEncoder(ENCODING_ID_MD5)
messsageDigestPasswordEncoderMD5.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messsageDigestPasswordEncoderMD5.iterations = conf.password.hash.iterations // 10000
MessageDigestPasswordEncoder messageDigestPasswordEncoderMD5 = new MessageDigestPasswordEncoder(ENCODING_ID_MD5)
messageDigestPasswordEncoderMD5.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messageDigestPasswordEncoderMD5.iterations = conf.password.hash.iterations // 10000

MessageDigestPasswordEncoder messsageDigestPasswordEncoderSHA1 = new MessageDigestPasswordEncoder(ENCODING_ID_SHA1)
messsageDigestPasswordEncoderSHA1.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messsageDigestPasswordEncoderSHA1.iterations = conf.password.hash.iterations // 10000
MessageDigestPasswordEncoder messageDigestPasswordEncoderSHA1 = new MessageDigestPasswordEncoder(ENCODING_ID_SHA1)
messageDigestPasswordEncoderSHA1.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messageDigestPasswordEncoderSHA1.iterations = conf.password.hash.iterations // 10000

MessageDigestPasswordEncoder messsageDigestPasswordEncoderSHA256 = new MessageDigestPasswordEncoder(ENCODING_IDSHA256)
messsageDigestPasswordEncoderSHA256.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messsageDigestPasswordEncoderSHA256.iterations = conf.password.hash.iterations // 10000
MessageDigestPasswordEncoder messageDigestPasswordEncoderSHA256 = new MessageDigestPasswordEncoder(ENCODING_IDSHA256)
messageDigestPasswordEncoderSHA256.encodeHashAsBase64 = conf.password.encodeHashAsBase64 // false
messageDigestPasswordEncoderSHA256.iterations = conf.password.hash.iterations // 10000

int strength = conf.password.bcrypt.logrounds
[(ENCODING_ID_BCRYPT): new BCryptPasswordEncoder(strength),
(ENCODING_ID_LDAP): new LdapShaPasswordEncoder(),
(ENCODING_ID_MD4): new Md4PasswordEncoder(),
(ENCODING_ID_MD5): messsageDigestPasswordEncoderMD5,
(ENCODING_ID_NOOP): NoOpPasswordEncoder.getInstance(),
(ENCODING_ID_PBKDF2): new Pbkdf2PasswordEncoder(),
(ENCODING_ID_SCRYPT): new SCryptPasswordEncoder(),
(ENCODING_ID_SHA1): messsageDigestPasswordEncoderSHA1,
(ENCODING_IDSHA256): messsageDigestPasswordEncoderSHA256,
"sha256": new StandardPasswordEncoder()]
(ENCODING_ID_LDAP): new LdapShaPasswordEncoder(),
(ENCODING_ID_MD4): new Md4PasswordEncoder(),
(ENCODING_ID_MD5): messageDigestPasswordEncoderMD5,
(ENCODING_ID_NOOP): NoOpPasswordEncoder.getInstance(),
(ENCODING_ID_PBKDF2): new Pbkdf2PasswordEncoder(),
(ENCODING_ID_SCRYPT): new SCryptPasswordEncoder(),
(ENCODING_ID_ARGON2): new Argon2PasswordEncoder(),
(ENCODING_ID_SHA1): messageDigestPasswordEncoderSHA1,
(ENCODING_IDSHA256): messageDigestPasswordEncoderSHA256,
"sha256": new StandardPasswordEncoder()]
}
}

0 comments on commit 48398c2

Please sign in to comment.