4 Commits

Author	SHA1	Message	Date
Vijayendra Bhamidipati	2dbdc46337	CLOUDSTACK-1734: Make SHA1 default password encoding mechanism ... Description: Making SHA256SALT the default encoding algorithm to encode passwords when creating/updating users. Introducing a new configurable list to allow admins to separately configure the order of preference for encoding and authentication schemes. Since passwords are now sent by clients as clear text, fixing the Plain text authenticator to check against the password passed in rather than its md5 digest.	2013-04-02 17:40:50 -07:00
Alex Huang	fac2270240	more files changed	2013-01-10 15:29:14 -08:00
Alex Huang	56e5fbdee2	removed import of componentlocator and inject from all files	2013-01-10 11:44:47 -08:00
Hugo Trippaers	bd58ceccd8	Summary: Make the authenticator responsible for encoding the password and add a SHA256 salted authenticator ... The authenticators now have an encode function that cloudstack will use to encode the user supplied password before storing it in the database. This makes it easier to add other authenticators with other hashing algorithms. The requires a two step approach to creating the admin account at first start as the authenticators are only present in the management-server component locator. The SHA256 salted authenticator make use of this new system and adds a hashing algorithm based on SHA256 with a salt. This type of hash is far less susceptible to rainbow table attacks. To make use of these new features the users password will be sent over the wire just as he typed it and it will be transformed into a hash on the server and compared with the stored password. This means that the hash will not go over the wire anymore. The default authenticator in components.xml is still set to md5 for backwards compatibility. For new installations the sha256 could be enabled.	2012-10-30 12:56:56 +01:00