View Javadoc

1   /* Copyright 2004 Acegi Technology Pty Limited
2    *
3    * Licensed under the Apache License, Version 2.0 (the "License");
4    * you may not use this file except in compliance with the License.
5    * You may obtain a copy of the License at
6    *
7    *     http://www.apache.org/licenses/LICENSE-2.0
8    *
9    * Unless required by applicable law or agreed to in writing, software
10   * distributed under the License is distributed on an "AS IS" BASIS,
11   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12   * See the License for the specific language governing permissions and
13   * limitations under the License.
14   */
15  
16  package org.acegisecurity.providers.encoding;
17  
18  /***
19   * <p>
20   * Plaintext implementation of PasswordEncoder.
21   * </p>
22   * 
23   * <P>
24   * As callers may wish to extract the password and salts separately from the
25   * encoded password, the salt must not contain reserved characters
26   * (specifically '{' and '}').
27   * </p>
28   *
29   * @author colin sampaleanu
30   * @author Ben Alex
31   * @version $Id: PlaintextPasswordEncoder.java,v 1.4 2005/11/17 00:55:49 benalex Exp $
32   */
33  public class PlaintextPasswordEncoder extends BasePasswordEncoder {
34      //~ Instance fields ========================================================
35  
36      private boolean ignorePasswordCase = false;
37  
38      //~ Methods ================================================================
39  
40      /***
41       * Indicates whether the password comparison is case sensitive.
42       * 
43       * <P>
44       * Defaults to <code>false</code>, meaning an exact case match is required.
45       * </p>
46       *
47       * @param ignorePasswordCase set to <code>true</code> for less stringent
48       *        comparison
49       */
50      public void setIgnorePasswordCase(boolean ignorePasswordCase) {
51          this.ignorePasswordCase = ignorePasswordCase;
52      }
53  
54      public boolean isIgnorePasswordCase() {
55          return ignorePasswordCase;
56      }
57  
58      public boolean isPasswordValid(String encPass, String rawPass, Object salt) {
59          String pass1 = encPass + "";
60  
61          // Strict delimiters is false because pass2 never persisted anywhere
62          // and we want to avoid unnecessary exceptions as a result (the
63          // authentication will fail as the encodePassword never allows them)
64          String pass2 = mergePasswordAndSalt(rawPass, salt, false);
65  
66          if (!ignorePasswordCase) {
67              return pass1.equals(pass2);
68          } else {
69              return pass1.equalsIgnoreCase(pass2);
70          }
71      }
72  
73      public String encodePassword(String rawPass, Object salt) {
74          return mergePasswordAndSalt(rawPass, salt, true);
75      }
76  
77      /***
78       * Demerges the previously {@link #encodePassword(String,
79       * Object)}<code>String</code>.
80       * 
81       * <P>
82       * The resulting array is guaranteed to always contain two elements. The
83       * first is the password, and the second is the salt.
84       * </p>
85       * 
86       * <P>
87       * Throws an exception if <code>null</code> or an empty <code>String</code>
88       * is passed to the method.
89       * </p>
90       *
91       * @param password from {@link #encodePassword(String, Object)}
92       *
93       * @return an array containing the password and salt
94       */
95      public String[] obtainPasswordAndSalt(String password) {
96          return demergePasswordAndSalt(password);
97      }
98  }