@Test public void testValidateWherePasswordInDBisMalfomred() throws Exception { int count = 0; try { PasswordUtils.validate("password", "password", "PBKDF2WithHmacSHA1"); } catch (SaturnJobConsoleException e) { count++; assertEquals(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, e.getErrorCode()); } assertEquals(1, count); }
public static void validate(String password, String passwordInDB, String hashMethod) throws SaturnJobConsoleException { if (!isHashMethodSupported(hashMethod)) { throw new SaturnJobConsoleException(String.format("hash method [%s] is not supported", hashMethod)); } if (PasswordUtils.HASH_METHOD_PLANTEXT.equals(hashMethod)) { if (!password.equals(passwordInDB)) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } return; } String[] saltAndPassword = passwordInDB.split("\\$"); if (saltAndPassword.length != 2) { log.debug("malformed password in db"); throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } String hashOfRequestPassword; try { hashOfRequestPassword = hash(password, getSalt(saltAndPassword[1])); } catch (Exception e) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } if (!hashOfRequestPassword.equals(new String(saltAndPassword[0]))) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } }
PasswordUtils { public static void validate(String password, String passwordInDB, String hashMethod) throws SaturnJobConsoleException { if (!isHashMethodSupported(hashMethod)) { throw new SaturnJobConsoleException(String.format("hash method [%s] is not supported", hashMethod)); } if (PasswordUtils.HASH_METHOD_PLANTEXT.equals(hashMethod)) { if (!password.equals(passwordInDB)) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } return; } String[] saltAndPassword = passwordInDB.split("\\$"); if (saltAndPassword.length != 2) { log.debug("malformed password in db"); throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } String hashOfRequestPassword; try { hashOfRequestPassword = hash(password, getSalt(saltAndPassword[1])); } catch (Exception e) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } if (!hashOfRequestPassword.equals(new String(saltAndPassword[0]))) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } } }
PasswordUtils { public static void validate(String password, String passwordInDB, String hashMethod) throws SaturnJobConsoleException { if (!isHashMethodSupported(hashMethod)) { throw new SaturnJobConsoleException(String.format("hash method [%s] is not supported", hashMethod)); } if (PasswordUtils.HASH_METHOD_PLANTEXT.equals(hashMethod)) { if (!password.equals(passwordInDB)) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } return; } String[] saltAndPassword = passwordInDB.split("\\$"); if (saltAndPassword.length != 2) { log.debug("malformed password in db"); throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } String hashOfRequestPassword; try { hashOfRequestPassword = hash(password, getSalt(saltAndPassword[1])); } catch (Exception e) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } if (!hashOfRequestPassword.equals(new String(saltAndPassword[0]))) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } }  }
PasswordUtils { public static void validate(String password, String passwordInDB, String hashMethod) throws SaturnJobConsoleException { if (!isHashMethodSupported(hashMethod)) { throw new SaturnJobConsoleException(String.format("hash method [%s] is not supported", hashMethod)); } if (PasswordUtils.HASH_METHOD_PLANTEXT.equals(hashMethod)) { if (!password.equals(passwordInDB)) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } return; } String[] saltAndPassword = passwordInDB.split("\\$"); if (saltAndPassword.length != 2) { log.debug("malformed password in db"); throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } String hashOfRequestPassword; try { hashOfRequestPassword = hash(password, getSalt(saltAndPassword[1])); } catch (Exception e) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } if (!hashOfRequestPassword.equals(new String(saltAndPassword[0]))) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } }  static String genPassword(String password, String hashMethod); static String genPassword(String password, byte[] salt, String hashMethod); static String hash(String password, byte[] salt); static void validate(String password, String passwordInDB, String hashMethod); static boolean isHashMethodSupported(String hashMethod); }
PasswordUtils { public static void validate(String password, String passwordInDB, String hashMethod) throws SaturnJobConsoleException { if (!isHashMethodSupported(hashMethod)) { throw new SaturnJobConsoleException(String.format("hash method [%s] is not supported", hashMethod)); } if (PasswordUtils.HASH_METHOD_PLANTEXT.equals(hashMethod)) { if (!password.equals(passwordInDB)) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } return; } String[] saltAndPassword = passwordInDB.split("\\$"); if (saltAndPassword.length != 2) { log.debug("malformed password in db"); throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } String hashOfRequestPassword; try { hashOfRequestPassword = hash(password, getSalt(saltAndPassword[1])); } catch (Exception e) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } if (!hashOfRequestPassword.equals(new String(saltAndPassword[0]))) { throw new SaturnJobConsoleException(SaturnJobConsoleException.ERROR_CODE_AUTHN_FAIL, "用户名或密码不正确"); } }  static String genPassword(String password, String hashMethod); static String genPassword(String password, byte[] salt, String hashMethod); static String hash(String password, byte[] salt); static void validate(String password, String passwordInDB, String hashMethod); static boolean isHashMethodSupported(String hashMethod); static final String HASH_METHOD_PLANTEXT; static final String HASH_METHOD_PBKDF2; }