org.jasypt.springsecurity3.authentication.encoding

## Class PasswordEncoder

- Object
- - org.jasypt.springsecurity3.authentication.encoding.PasswordEncoder

- All Implemented Interfaces:
    org.springframework.security.authentication.encoding.PasswordEncoder

      public final class PasswordEncoder
      extends Object
      implements org.springframework.security.authentication.encoding.PasswordEncoder

  This class implements the Spring Security 3.x `org.springframework.security.authentication.encoding.PasswordEncoder` interface, allowing Spring Security-enabled applications to use JASYPT for password encryption.

  Objects of this class will internally hold either an object of type `org.jasypt.util.password.PasswordEncryptor` or an object of type `org.jasypt.digest.StringDigester` (only one of them), which should be set by respectively calling `setPasswordEncryptor(PasswordEncryptor)` or `setStringDigester(StringDigester)` after creation. If neither a `PasswordEncryptor` nor a `StringDigester` are set, a new `org.jasypt.util.password.BasicPasswordEncryptor` object is created and internally used.

  Important: This implementation ignores any salt provided through the interface methods, as the internal Jasypt `PasswordEncryptor` or `StringDigester` objects normally use a random one. This means that salt can be safely passed as `null`.

  Usage with a PasswordEncryptor

  This class can be used like this from your Spring XML resource files:

        ...
        <!-- Your application may use the PasswordEncryptor in several places, -->
        <!-- like for example at new user sign-up.                             -->
        <bean id="jasyptPasswordEncryptor" class="org.jasypt.util.password.StrongPasswordEncryptor" />
        ...
        ...
        <!-- This Spring Security-friendly PasswordEncoder implementation will -->
        <!-- wrap the PasswordEncryptor instance so that it can be used from   -->
        <!-- the security framework.                                           -->
        <bean id="passwordEncoder" class="org.jasypt.spring.security2.PasswordEncoder">
          <property name="passwordEncryptor">
            <ref bean="jasyptPasswordEncryptor" />
          </property>
        </bean>
        ...
        ...
        <!-- Your DaoAuthenticationProvider will then use it like with any     -->
        <!-- other implementation of the PasswordEncoder interface.            -->
        <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
            <property name="userDetailsService" ref="userDetailsService"/>
            <property name="passwordEncoder">
              <ref bean="passwordEncoder" />
            </property>
        </bean>
        ...

  Usage with a StringDigester

  This class can be used like this from your Spring XML resource files:

        ...
        <!-- Your application may use the StringDigester in several places,    -->
        <!-- like for example at new user sign-up.                             -->
        <bean id="jasyptStringDigester" class="org.jasypt.digest.StandardStringDigester" >
          <property name="algorithm" value="SHA-1" />
          <property name="iterations" value="100000" />
        </bean>
        ...
        ...
        <!-- This Spring Security-friendly PasswordEncoder implementation will -->
        <!-- wrap the StringDigester instance so that it can be used from      -->
        <!-- the security framework.                                           -->
        <bean id="passwordEncoder" class="org.jasypt.spring.security2.PasswordEncoder">
          <property name="stringDigester">
            <ref bean="jasyptStringDigester" />
          </property>
        </bean>
        ...
        ...
        <!-- Your DaoAuthenticationProvider will then use it like with any     -->
        <!-- other implementation of the PasswordEncoder interface.            -->
        <bean id="daoAuthenticationProvider" class="org.springframework.security.providers.dao.DaoAuthenticationProvider">
            <property name="userDetailsService" ref="userDetailsService"/>
            <property name="passwordEncoder">
              <ref bean="passwordEncoder" />
            </property>
        </bean>
        ...

  This class is thread-safe

  Since:
    1.9.0 (existed as org.jasypt.spring.security3.PasswordEncoder since 1.6)
  Author:
    Daniel Fernández

- - ### Constructor Summary

    Constructors
    Constructor and Description
    `PasswordEncoder()` Creates a new instance of `PasswordEncoder`

  - ### Method Summary

    All Methods Instance Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `String` | `encodePassword(String rawPass, Object salt)` Encodes a password.
    `boolean` | `isPasswordValid(String encPass, String rawPass, Object salt)` Checks a password's validity.
    `void` | `setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor)` Sets a password encryptor to be used.
    `void` | `setStringDigester(org.jasypt.digest.StringDigester stringDigester)` Sets a string digester to be used.

    - ### Methods inherited from class Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Constructor Detail

    - #### PasswordEncoder

          public PasswordEncoder()

      Creates a new instance of `PasswordEncoder`

  - ### Method Detail

    - #### setPasswordEncryptor

          public void setPasswordEncryptor(org.jasypt.util.password.PasswordEncryptor passwordEncryptor)

      Sets a password encryptor to be used. Only one of `setPasswordEncryptor` or `setStringDigester` should be called. If both are, the last call will define which method will be used.
      Parameters:
        `passwordEncryptor` - the password encryptor instance to be used.

    - #### setStringDigester

          public void setStringDigester(org.jasypt.digest.StringDigester stringDigester)

      Sets a string digester to be used. Only one of `setPasswordEncryptor` or `setStringDigester` should be called. If both are, the last call will define which method will be used.
      Parameters:
        `stringDigester` - the string digester instance to be used.

    - #### encodePassword

          public String encodePassword(String rawPass,
                                       Object salt)

      Encodes a password. This implementation completely ignores salt, as jasypt's `PasswordEncryptor` and `StringDigester` normally use a random one. Thus, it can be safely passed as `null`.
      Specified by:
        `encodePassword` in interface `org.springframework.security.authentication.encoding.PasswordEncoder`
      Parameters:
        `rawPass` - The password to be encoded.
        `salt` - The salt, which will be ignored. It can be null.

    - #### isPasswordValid

          public boolean isPasswordValid(String encPass,
                                         String rawPass,
                                         Object salt)

      Checks a password's validity. This implementation completely ignores salt, as jasypt's `PasswordEncryptor` and `StringDigester` normally use a random one. Thus, it can be safely passed as `null`.
      Specified by:
        `isPasswordValid` in interface `org.springframework.security.authentication.encoding.PasswordEncoder`
      Parameters:
        `encPass` - The encrypted password (digest) against which to check.
        `rawPass` - The password to be checked.
        `salt` - The salt, which will be ignored. It can be null.

Copyright © 2019 The JASYPT team. All rights reserved.