Gentlepeople, it's running. 
With salted password hashing. I'm able to change my own users password.
An admin is able to add/change users passwords on his behalf and the correct password is set then.
@Ben: If you're reading this sometime.
Wouldn't it make sense to put the following hints to the FAQ at least?:
- Simple PasswordGenerator. Found the source code here in the board, modified it a bit to get it running.:
Code:
import net.sf.acegisecurity.providers.encoding.Md5PasswordEncoder;
/**
/**
* @author ashaman
* @date 05.10.2005
*/
public class PasswordGenerator {
private Md5PasswordEncoder encoder = new Md5PasswordEncoder();
public PasswordGenerator(){};
private String generateHashedPassword(String password, String saltString) {
return encoder.encodePassword(password,saltString);
}
public static void main(String[] args) {
PasswordGenerator generator = new PasswordGenerator();
System.out.println("Hashed password: " + generator.generateHashedPassword("password", "$1$simpsons$"));
System.out.println("Hashed password: " + generator.generateHashedPassword("password", "testSalt"));
System.out.println("Hashed password: " + generator.generateHashedPassword("initial", "tbecker"));
}
}
It's very important to be able to check the password encryption, when inserting new users or changing user's passwords.
To encrypt passwords in the application for updating/adding users (selfcare and/or by admin) I wrote the following small util class. It just crypts the password for you (to store in persistenz layer and/or update the SecureContext with new credentials):
Code:
/**
package com.vodafone.util;
import net.sf.acegisecurity.providers.dao.salt.ReflectionSaltSource;
/**
* @author Beckert
* @since: Oct 5, 2005
*/
public final class EncodePasswordUtil {
private static final Md5PasswordEncoder encoder = new Md5PasswordEncoder();
public static String encodePassword(final String password, final String salt {
return encoder.encodePassword(password,salt);
}
}
I highly missed this configuration in the referencedocumentation:
Code:
<bean id="saltSource" class="net.sf.acegisecurity.providers.dao.salt.ReflectionSaltSource">
<property name="userPropertyToUse"><value>getUsername</value></property>
</bean>
Sure, you can find out yourself with the API. But I didn't...the forum saved me here again.
And the steps needed for updating passwords should be mentioned in the FAQ. You can find that here in the board, but the first glance is always in the FAQ and searching it there is way faster and more comfortable.
Would really great if you can add that to the documentation. This would have made my work a lot easier, even if changing passwords and stuff are not part of acegi but the application, there's a strong relationship here from my point of view.
Last but not least: Thanks for all the work. It was very hard (for me, since I'm a java/spring novice and only hobby programmer) to get where I'am, but Acegi gives me exactly what I need for security. Next time it'll be much easier for me. And thanks for the support in the board and keeping answering people's questions here.
Cheers,
Thomas
ps: Next step is to get caching running...
Edit: Ok, caching was an easy one. It ran after the first try. It's getting fun again.
Acegi running fine. Howto add roles, ...
