[SHIRO-327] HashedCredentialsMatcher getCredentials() bug

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Problem
• Affects Version/s: 1.1.0
• Fix Version/s: 1.1.0
• Component/s: Authorization (access control) , Cryptography & Hashing
• Environment: irrelevant
• Assignee: Unassigned
• Reporter: Tudor Raneti
• Created: 28/Sep/11 07:27
• Updated: 24/Jan/12 19:19
• Resolved: 28/Sep/11 15:23

Description

isStoredCredentialsHexEncoded() always returns true, no matter if I store a hex or a base64 password or credential. Hex is Base16. Authentication fails if I store Base64 with an IllegalArgumentException because Hex.decode(...) doesn't recognize but the 0..9 and a..f alphabet

Code quote:

//account.credentials were a char[] or String, so
//we need to do text decoding first:
if (isStoredCredentialsHexEncoded())

{ storedBytes = Hex.decode(storedBytes); }

else

{ storedBytes = Base64.decode(storedBytes); }

...
from my ini:

1. password hashing specification
   sha256Matcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
   sha256Matcher.hashAlgorithmName=SHA-256