SpringBasedHonoPasswordEncoder implements HonoPasswordEncoder { @Override public boolean matches(final String rawPassword, final JsonObject credentialsOnRecord) { try { final EncodedPassword encodedPassword = EncodedPassword.fromHonoSecret(credentialsOnRecord); final PasswordEncoder encoder = Optional.ofNullable(encoders.get(encodedPassword.hashFunction)).orElse(encoderForEncode); return encoder.matches(rawPassword, encodedPassword.format()); } catch (final IllegalArgumentException e) { LOG.debug("error matching password", e); return false; } } SpringBasedHonoPasswordEncoder();  SpringBasedHonoPasswordEncoder(final int bcryptStrength);  SpringBasedHonoPasswordEncoder(final SecureRandom rng, final int bcryptStrength); @Override JsonObject encode(final String rawPassword); @Override boolean matches(final String rawPassword, final JsonObject credentialsOnRecord); static final int DEFAULT_BCRYPT_STRENGTH; }
@Test public void testMatchesFallsBackToDefaultHashFunction() { final String hashedPassword = getPasswordHash(CredentialsConstants.DEFAULT_HASH_FUNCTION, null, TEST_PASSWORD); final JsonObject candidateSecret = new JsonObject().put(CredentialsConstants.FIELD_SECRETS_PWD_HASH, hashedPassword); final String pwd = TEST_PASSWORD; assertTrue(encoder.matches(pwd, candidateSecret)); }
@Test public void testMatchesSucceedsForCorrectPassword() { final byte[] salt = "TheSalt".getBytes(StandardCharsets.UTF_8); final String hashedPassword = getPasswordHash(CredentialsConstants.HASH_FUNCTION_SHA512, salt, TEST_PASSWORD); final JsonObject candidateSecret = CredentialsObject.hashedPasswordSecretForPasswordHash( hashedPassword, CredentialsConstants.HASH_FUNCTION_SHA512, null, null, salt); final String pwd = TEST_PASSWORD; assertTrue(encoder.matches(pwd, candidateSecret)); }
@Test public void testMatchesSucceedsForMatchingBCryptPassword() { final JsonObject candidateSecret = CredentialsObject.hashedPasswordSecretForPasswordHash( "$2a$12$rcrgLZrGHkEMAMfP5atLGe4HOvI0ZdclQdWDt/6DfUcgNEphwK27i", CredentialsConstants.HASH_FUNCTION_BCRYPT, null, null, (byte[]) null); final String pwd = "kapua-password"; assertTrue(encoder.matches(pwd, candidateSecret)); }
@Test public void testMatchesCredentialsFailsForNonMatchingPassword() { final String hashedPassword = getPasswordHash(CredentialsConstants.HASH_FUNCTION_SHA512, null, TEST_PASSWORD); final JsonObject candidateSecret = CredentialsObject.hashedPasswordSecretForPasswordHash( hashedPassword, CredentialsConstants.HASH_FUNCTION_SHA512, Instant.now(), null, (byte[]) null); final String pwd = "wrongpassword"; assertFalse(encoder.matches(pwd, candidateSecret)); }
@Test public void testMatchesCredentialsFailsForMalformedPwdHash() { final JsonObject candidateSecret = new JsonObject() .put(CredentialsConstants.FIELD_TYPE, CredentialsConstants.SECRETS_TYPE_HASHED_PASSWORD) .put(CredentialsConstants.FIELD_SECRETS_PWD_HASH, "!NOT_BASE64!"); final String pwd = TEST_PASSWORD; assertFalse(encoder.matches(pwd, candidateSecret)); }
@Test public void testMatchesCredentialsFailsForMalformedSalt() { final String hashedPassword = getPasswordHash(CredentialsConstants.DEFAULT_HASH_FUNCTION, null, TEST_PASSWORD); final JsonObject candidateSecret = new JsonObject() .put(CredentialsConstants.FIELD_TYPE, CredentialsConstants.SECRETS_TYPE_HASHED_PASSWORD) .put(CredentialsConstants.FIELD_SECRETS_PWD_HASH, hashedPassword) .put(CredentialsConstants.FIELD_SECRETS_SALT, "!NOT_BASE64!"); final String pwd = TEST_PASSWORD; assertFalse(encoder.matches(pwd, candidateSecret)); }