From 9dd4caf806967b8adbcc89ae262ce85425445272 Mon Sep 17 00:00:00 2001 From: radhikap Date: Thu, 11 Jul 2013 11:05:44 +0530 Subject: [PATCH] CLOUDSTACK-1815 --- docs/en-US/password-storage-engine.xml | 38 ++++++++++++++++++-------- 1 file changed, 26 insertions(+), 12 deletions(-) diff --git a/docs/en-US/password-storage-engine.xml b/docs/en-US/password-storage-engine.xml index b1d5340ef94..05661055e9b 100644 --- a/docs/en-US/password-storage-engine.xml +++ b/docs/en-US/password-storage-engine.xml @@ -21,21 +21,27 @@ -->
Changing the Default Password Encryption - &PRODUCT; allows you to determine the default encoding and authentication mechanism for - admin and user logins. Plain text user authenticator has been changed to do a simple string - comparison between retrieved and supplied login passwords instead of comparing the retrieved md5 - hash of the stored password against the supplied md5 hash of the password because clients no - longer hash the password. The following method determines what encoding scheme is used to encode - the password supplied during user creation or modification. + Passwords are encoded when creating or updating users. &PRODUCT; allows you to determine the + default encoding and authentication mechanism for admin and user logins. A new configurable list + called UserPasswordEncoders to allow you to separately configure the order of + preference for encoding and authentication schemes. + Additionally, plain text user authenticator has been changed to use SHA256SALT as the + default encoding algorithm because it is more secure compared to MD5 hashing. It does a simple + string comparison between retrieved and supplied login passwords instead of comparing the + retrieved md5 hash of the stored password against the supplied md5 hash of the password because + clients no longer hash the password. The following method determines what encoding scheme is + used to encode the password supplied during user creation or modification. When a new user is created, the user password is encoded by using the first valid encoder loaded as per the sequence specified in the UserPasswordEncoders property in the ComponentContext.xml or nonossComponentContext.xml files. The order of authentication schemes is determined by the UserAuthenticators - property in the same files. The administrator can change the ordering of both these properties - as preferred. When a new authenticator or encoder is added, you can add them to this list. While - doing so, ensure that the new authenticator or encoder is specified as a bean in both these - files if they are required for both oss and non-oss components. The two properties are listed - below: + property in the same files. When a new authenticator or encoder is added, you can add them to + this list. While doing so, ensure that the new authenticator or encoder is specified as a bean + in both these files. The administrator can change the ordering of both these properties as + preferred to change the order of schemes. Modify the following list properties available in + client/tomcatconf/nonossComponentContext.xml.in or + client/tomcatconf/componentContext.xml.in as applicable, to the desired + order: <property name="UserAuthenticators"> <list> <ref bean="SHA256SaltedUserAuthenticator"/> @@ -50,5 +56,13 @@ <ref bean="MD5UserAuthenticator"/> <ref bean="LDAPUserAuthenticator"/> <ref bean="PlainTextUserAuthenticator"/> - </list> + </list> + In the above default ordering, SHA256Salt is used first for + UserPasswordEncoders. If the module is found and encoding returns a valid value, + the encoded password is stored in the user table's password column. If it fails for any reason, + the MD5UserAuthenticator will be tried next, and the order continues. For + UserAuthenticators, SHA256Salt authentication is tried first. If it succeeds, the + user is logged into the Management server. If it fails, MD5 is tried next, and attempts + continues until any of them succeeds and the user logs in . If none of them works, the user is + returned an invalid credential message.