Acegi password encryption

Question

Hi! I am using the acegi groovy plugin for user registration and authentication. The User domain class which comes with the plug-in has the following definition (and comments).

class User {
static transients = ['pass']
static hasMany = [authorities: Role]
static belongsTo = Role

/** Username */
String username
/** User Real Name*/
String userRealName
/** MD5 Password */
String passwd
/** enabled */
boolean enabled

String email
boolean emailShow

/** description */
String description = ''
...

}

and so on. Therefore I've assumed that the password encryption method is MD5.

I have to register many thousand of users, generating a random password for each user. (username is already given).

I wrote a script which generates random -plain- passwords and MD5 Encrypted paswords and make the respective inserts into the DB. Unfortunately none of these users can log in.

Is the acegi security plug in using MD5 encryption?

Seems to be that it is using something else. Unfortunately I didn't find anything at the documentation.

Anybody knows how is this encryption done?

Thanks!

Luis

Answer 1

If you are using DaoAuthenticationProvider and do not set the passwordEncoder property, the default password encoder is PlaintextPasswordEncoder. To configure an MD5 password encoder, do

  <bean
      id="passwordEncoder"
      class="org.acegisecurity.providers.encoding.Md5PasswordEncoder"/>

  <bean
      id="daoAuthenticationProvider"
      class="org.acegisecurity.providers.dao.DaoAuthenticationProvider">
    <property name="userDetailsService" ref="userDetailsService"/>
    <property name="passwordEncoder" ref="passwordEncoder"/>
  </bean>

Answer 2

or you could use the authenticateService.encodePassword("password"). See the plugin's RegisterController's save method for example