Examples with PasswordEncoder org.springframework.security.crypto.password.PasswordEncoder used on opensource projects

Example 11 with PasswordEncoder

use of org.springframework.security.crypto.password.PasswordEncoder in project spring-security by spring-projects.

the class DaoAuthenticationProviderTests method testUserNotFoundNullCredentials.

@Test
public void testUserNotFoundNullCredentials() {
    UsernamePasswordAuthenticationToken token = new UsernamePasswordAuthenticationToken("missing", null);
    PasswordEncoder encoder = mock(PasswordEncoder.class);
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setHideUserNotFoundExceptions(false);
    provider.setPasswordEncoder(encoder);
    provider.setUserDetailsService(new MockAuthenticationDaoUserrod());
    try {
        provider.authenticate(token);
        fail("Expected Exception");
    } catch (UsernameNotFoundException success) {
    }
    verify(encoder, times(0)).matches(anyString(), anyString());
}

Example 12 with PasswordEncoder

use of org.springframework.security.crypto.password.PasswordEncoder in project spring-security by spring-projects.

the class DaoAuthenticationProviderTests method IGNOREtestSec2056.

/**
	 * This is an explicit test for SEC-2056. It is intentionally ignored since this test
	 * is not deterministic and {@link #testUserNotFoundEncodesPassword()} ensures that
	 * SEC-2056 is fixed.
	 */
public void IGNOREtestSec2056() {
    UsernamePasswordAuthenticationToken foundUser = new UsernamePasswordAuthenticationToken("rod", "koala");
    UsernamePasswordAuthenticationToken notFoundUser = new UsernamePasswordAuthenticationToken("notFound", "koala");
    PasswordEncoder encoder = new BCryptPasswordEncoder(10, new SecureRandom());
    DaoAuthenticationProvider provider = new DaoAuthenticationProvider();
    provider.setHideUserNotFoundExceptions(false);
    provider.setPasswordEncoder(encoder);
    MockAuthenticationDaoUserrod userDetailsService = new MockAuthenticationDaoUserrod();
    userDetailsService.password = encoder.encode((CharSequence) foundUser.getCredentials());
    provider.setUserDetailsService(userDetailsService);
    int sampleSize = 100;
    List<Long> userFoundTimes = new ArrayList<Long>(sampleSize);
    for (int i = 0; i < sampleSize; i++) {
        long start = System.currentTimeMillis();
        provider.authenticate(foundUser);
        userFoundTimes.add(System.currentTimeMillis() - start);
    }
    List<Long> userNotFoundTimes = new ArrayList<Long>(sampleSize);
    for (int i = 0; i < sampleSize; i++) {
        long start = System.currentTimeMillis();
        try {
            provider.authenticate(notFoundUser);
            fail("Expected Exception");
        } catch (UsernameNotFoundException success) {
        }
        userNotFoundTimes.add(System.currentTimeMillis() - start);
    }
    double userFoundAvg = avg(userFoundTimes);
    double userNotFoundAvg = avg(userNotFoundTimes);
    assertThat(Math.abs(userNotFoundAvg - userFoundAvg) <= 3).withFailMessage("User not found average " + userNotFoundAvg + " should be within 3ms of user found average " + userFoundAvg).isTrue();
}