Actions
Task #265
closed
Password entity
Start date:
01/10/2017
Due date:
% Done:
100%
Estimated time:
Owner:
Description
- New password entity with metadata (validTill, min expire, expired, ...),
- password change, reset, work with new entity, (NO confidential storage),
- create identity, create new row,
- passwordHistory entity, change password add old row to table Password History. Password history is for check old passwords.
Related issues
Updated by Ondřej Kopr over 7 years ago
- Related to Task #263: Passwords policy added
Updated by Ondřej Kopr over 7 years ago
- % Done changed from 30 to 60
- I was implement two different methods for hashing passwords:
- > Bcrypt from http://docs.spring.io/spring-security/site/docs/current/apidocs/org/springframework/security/crypto/bcrypt/BCrypt.html
- > PBKDF2 as algorithm from SecretKeyFactory javax.crypto,
- both have samo advantages,
- > Bcrypt - easy implement
- > PBKDF2 - quick
- and disvantages:
- > Bcrypt > slow - Password: 'T3st@#te_st12' | hash: $2a$13$3k7xrleknYmZ.9v.mcfUie6ooVUchoPRqer.SPGAGemlL/khbCx1q | Salt : $2a$13$3k7xrleknYmZ.9v.mcfUie | Time: 771ms
- > PBKDF2 - less secure than bcrypt.
- bcrypt - own salt generate method, salt is part of password see above,
- PBKDF2 - for salt is use as salt identities UUID transform to logn digs,.
Now I wait for response from ZB.
Updated by Ondřej Kopr over 7 years ago
Implement
- password must change - when user login, must change password,
- password expire, user can't login?
Updated by Ondřej Kopr over 7 years ago
- Status changed from In Progress to Needs feedback
- Assignee changed from Ondřej Kopr to Radek Tomiška
Please check if you do feedback in task #266, otherwise please check this new entity. Thank you Radek.
Updated by Radek Tomiška about 7 years ago
- Status changed from Needs feedback to In Progress
- Assignee changed from Radek Tomiška to Ondřej Kopr
I did test and review and source code looks nice, API is clean and readable, everything works, thx.
Some minor:- transactions are missing in DefaultIdmPasswordService. Its not required now, because just one operation on repository is executed, but i like transactions (normal / readonly) on services :)
Updated by Ondřej Kopr about 7 years ago
method save and delete was transform for work with processors
Updated by Ondřej Kopr about 7 years ago
- Status changed from In Progress to Needs feedback
- Assignee changed from Ondřej Kopr to Radek Tomiška
Updated by Radek Tomiška about 7 years ago
- Status changed from Needs feedback to Closed
- Assignee changed from Radek Tomiška to Ondřej Kopr
- % Done changed from 90 to 100
Its nice, thx.
Actions