[CWD-3104] Use a random salt for SSHA password encoding

Type: Suggestion
Resolution: Fixed
Fix Version/s: 2.6.1
Component/s: Directory - LDAP
Labels:
None

Feedback Policy:

Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

LdapSshaPasswordEncoder uses a site-wide salt value. This is enough to prevent cracking passwords with hashes from another instance, but random salt would improve resistance to a site-wide attempt at password cracking, as well as hiding cases of password collision between users.

blocks

CWD-3105 Remove TokenSeed now it's no longer used

Closed

relates to

CWD-3095 Add default salt generation when a PropertyManager has not been injected in the ssha password encoder

Closed

mentioned in: Wiki Page Failed to load

Form Name

No work has yet been logged on this issue.

Assignee:: joe

Reporter:: joe

Votes:: 0 Vote for this issue

Watchers:: 1 Start watching this issue

Created:: 01/Feb/2013 3:28 AM

Updated:: 19/Sep/2019 5:51 AM

Resolved:: 07/Feb/2013 11:08 PM

Details

Description

Attachments

Issue Links

Forms

Activity

People

Dates