[DERBY-3272] BUILTIN authentication: Passwords stored in a database are not hashed if also defined as system property

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 10.3.2.1
• Fix Version/s: 10.9.1.0
• Component/s: Services
• Labels: derby_backport_reject_10_8 derby_triage10_5_2
• Environment: BUILTIN authentication enabled
• Urgency: Normal
• Issue & fix info: Known fix, Newcomer, Workaround attached
• Bug behavior facts: Security
• Assignee: Unassigned
• Reporter: John Embretsen
• Created: 12/Dec/07 16:23
• Updated: 08/Jul/13 20:29
• Resolved: 28/Dec/12 09:49

Description

Normally, passwords stored as database properties when using Derby's BUILTIN authentication provider are hashed using the well-known SHA-1 algorithm (although this is most likely not mentioned in the documentation). This makes it very hard for attackers to reconstruct the actual password even if they are able to obtain the hashed password value from the database.

However, if credentials for the same user are also defined programmatically, for example on the command line, the password is not hashed before it is being stored in the database. This could lead to surprises if, for example, a user is using system properties during development, and decides to switch to database properties only before deployment, as recommended in the documentation [1].

Workaround: Do not specify the same user credentials programmatically when setting credentials as database properties. For example, define a temporary user by using system properties when storing real user credentials in the database.

[1]: http://db.apache.org/derby/docs/dev/devguide/tdevcsecure82556.html

Issue Links

• is duplicated by: DERBY-3271 Using BUILTIN authentication, I can't log in as database creator after storing credentials in the database.
• is related to: DERBY-5507 Orderly shutdown fails if you are using BUILTIN authentication and turn on derby.database.propertiesOnly
• relates to: DERBY-3271 Using BUILTIN authentication, I can't log in as database creator after storing credentials in the database.