Encoded password does not look like BCrypt about spring-security-registration HOT 9 CLOSED

Sure.
First, open your security configuration which extends WebSecurityConfigurerAdapter and paste below function:

@Bean
public static PasswordEncoder passwordEncoder() {
      return PasswordEncoderFactories.createDelegatingPasswordEncoder();
}

Then in the same configuration file, modify your authenticationProvider() function like this:

 @Bean
 public DaoAuthenticationProvider authenticationProvider() {
      DaoAuthenticationProvider authenticationProvider = new DaoAuthenticationProvider();
      authenticationProvider.setUserDetailsService(customUserDetailsService);
      authenticationProvider.setPasswordEncoder(passwordEncoder());
      return authenticationProvider;
 }

Note: If you create multiple PasswordEncoder beans, the compiler will always select the first one. If you also need to implement NoOpPasswordEncoder, do it in the file that you really need to use it and create it without @Bean.

@SuppressWarnings("deprecation")
 public static NoOpPasswordEncoder passwordEncoder() {
     return (NoOpPasswordEncoder) NoOpPasswordEncoder.getInstance();
 }

@Autowired
private PasswordEncoder passwordEncoder;

from spring-security-registration.

Yes, I did. If you also have the same problem, you can follow here

from spring-security-registration.

I had to encode the client secret too. Don't know if that's the best practice.

@Override
public void configure(ClientDetailsServiceConfigurer configurer) throws Exception {
    configurer
            .inMemory()
            .withClient(clientId)
            .secret(passwordEncoder.encode(clientSecret))
            .authorizedGrantTypes(grantType)
            .scopes(scopeRead, scopeWrite)
            .resourceIds(resourceIds);
}

from spring-security-registration.

Issue has been fixed in the codebase after Boot 2 upgrade.

from spring-security-registration.

Hi @AlicanBalik I saw you closed the issue. Did you solve the problem?

from spring-security-registration.

@AlicanBalik Maybe you could explain how you did this fix? NOTE: I read the documentation, need to see some example. thks

from spring-security-registration.

It should be the same thing. Let's say:

private String clientSecret = "mySecret";
private String encodedClientSecret = passwordEncoder.encode(clientSecret); // assume encoded value is $%*@DJ#

configurer
            .inMemory()
            .withClient(clientId)
            .secret(encodedClientSecret)
            .authorizedGrantTypes(grantType)
            .scopes(scopeRead, scopeWrite)
            .resourceIds(resourceIds);

In this point, your secret is actually $%*@DJ#. If I have this value, I can bypass your security. The important thing is to secure your clientSecret value in the application.properties. There are many ways to secure that.

1. Default option: just put the value in the application.properties.
2. Better option: You can create one more .properties profile and put your value there. Then call that value in the application.properties. Important note for this one is that you must discard your new .properties file from the git so you won't push it anywhere.
   e.g.:
   application-local.properties:
   client.secret.hidden = mySecret
   --
   application.properties =
   client.secret = ${client.secret.hidden}
   Then call this value in your class:

@Value("${client.secret}")
private String clientSecret;

3. Use Spring Cloud to store your .properties.

4. The best for me: Store sensitive information in the db. (It requires different configuration, because you will no longer use configurer.inMemory() ....).

from spring-security-registration.

Maybe, You shoud check it :
https://stackoverflow.com/questions/49582971/encoded-password-does-not-look-like-bcrypt

from spring-security-registration.

This issue is still reproducible with Spring boot version 2.2.0 and Spring security 5.2.0 version with inmemory authentication.

` @Autowired
public void configureGlobal(AuthenticationManagerBuilder authenticationManagerBuilder) throws Exception {
authenticationManagerBuilder
.inMemoryAuthentication()
.withUser("hari")
.password("welcome")
.roles("USER")
.and()
.withUser("kiran")
.password("testing")
.roles("USER", "ADMIN")
.and()
.passwordEncoder(passwordEncoder());

@bean
public BCryptPasswordEncoder passwordEncoder(){
return new BCryptPasswordEncoder();
}
`

2019-11-03 19:10:50.962 WARN 14504 --- [nio-8080-exec-1] o.s.s.c.bcrypt.BCryptPasswordEncoder : Encoded password does not look like BCrypt

from spring-security-registration.