Comparing a String against db hashed password

Hi Devs,
Im trying to login into Camunda Engine from another application,
in the process i try to encrypt my raw string to SHA-512 string, using
Base64EncodedHashDigest class.
however the two strings are not the same,
Take a sample string;

String password = "pass";
String result = encrypt(password);

the above code returns
W3IrMH/ObJRJBdEyaR1eSiIUt/6StziSDrP846kEIKGVEcMBCg53ErBU2u9bV7rVnsvZOzKA8hBXj1R/Su1NJQ==

when i use that same string as a user password,
the password columns shows
{SHA-512}fggIdzB1Fg9jOA7thTTzuI8hJfxtU9Lhtl7APlIX1yk1gEbMBjtONM4LL1yWNUTrBgnh+OgHfkpqDTZoncrUQA==
im i missing out anything?

Hi @kavi,

Camunda adds a salt to the password before hashing it. You cannot produce the same hash without knowing the salt.

What are you trying to achieve? Why do you want to hash the password yourself?

Cheers,
Miklas

Thank you @Miklas for the response,
I have a springboot app where i embedded webapp but also provide other functionalities,
so i wanted to use Camunda user table for login with Spring Security.
I realised SpringSecurity nolonger use SHA-512, so i created my own PasswordEncoder.

public class SHA512Encoder extends Sha512HashDigest implements PasswordEncoder {
    @Override
    public String encode(CharSequence rawPassword) {
        return encrypt(rawPassword.toString());
    }

    @Override
    public boolean matches(CharSequence rawPassword, String encodedPassword) {
       return check(encrypt(rawPassword.toString()),encodedPassword);
    }
}

The Method matches always returns false thus Spring Security cannever authenticate me.

So a workaround not sure whether its a hack :slight_smile: in the matches method is just called
("{SHA-512}"+encrypt(rawPassword.toString())).equals(encodedPassword)
i queried the db by username, got the salt, added it to the un encoded password to get the rawPassword that i passed to Spring Security authenticate. i hope its not a hack.

Thank you @Miklas