[JAMES-2471] Changing a password should use latest configured hashing algorithm

• Type: Improvement
• Status: Open
• Priority: Major
• Resolution: Unresolved
• Affects Version/s: master
• Component/s: CLI, UsersStore & UsersRepository, webadmin
• Labels: security
• Assignee: Unassigned
• Reporter: Benoit Tellier
• Created: 17/Jul/18 05:06
• Updated: 17/Jul/18 06:48

Description

James stores users passwords hashed in a database.

The hashing algorithm is being stored on a per-user basis. However, when changing a password, the password is hashed with the algorithm configured at user creation (not the one used during the update).

We would need, when updating user password, to ensure we are using the currently configured algorithm.

This has to be working using James WebAdmin and CLI