Hi Devs,
Im trying to login into Camunda Engine from another application,
in the process i try to encrypt my raw string to SHA-512 string, using Base64EncodedHashDigest class.
however the two strings are not the same,
Take a sample string;
String password = "pass";
String result = encrypt(password);
the above code returns W3IrMH/ObJRJBdEyaR1eSiIUt/6StziSDrP846kEIKGVEcMBCg53ErBU2u9bV7rVnsvZOzKA8hBXj1R/Su1NJQ==
when i use that same string as a user password,
the password columns shows {SHA-512}fggIdzB1Fg9jOA7thTTzuI8hJfxtU9Lhtl7APlIX1yk1gEbMBjtONM4LL1yWNUTrBgnh+OgHfkpqDTZoncrUQA==
im i missing out anything?
Thank you @Miklas for the response,
I have a springboot app where i embedded webapp but also provide other functionalities,
so i wanted to use Camunda user table for login with Spring Security.
I realised SpringSecurity nolonger use SHA-512, so i created my own PasswordEncoder.
public class SHA512Encoder extends Sha512HashDigest implements PasswordEncoder {
@Override
public String encode(CharSequence rawPassword) {
return encrypt(rawPassword.toString());
}
@Override
public boolean matches(CharSequence rawPassword, String encodedPassword) {
return check(encrypt(rawPassword.toString()),encodedPassword);
}
}
The Method matches always returns false thus Spring Security cannever authenticate me.
So a workaround not sure whether its a hack in the matches method is just called ("{SHA-512}"+encrypt(rawPassword.toString())).equals(encodedPassword)
i queried the db by username, got the salt, added it to the un encoded password to get the rawPassword that i passed to Spring Security authenticate. i hope its not a hack.