Tomcat 10.1.19 · org.apache.catalina.realm.DigestCredentialHandlerBase

Modifier and Type	Field and Description
public static final int	DEFAULT_SALT_LENGTH
private int	iterations
private boolean	logInvalidStoredCredentials
private volatile Random	random
private final Object	randomLock
private int	saltLength
protected static final StringManager	sm

Access	Constructor and Description
public	DigestCredentialHandlerBase()

Method Summary

Modifier and Type	Method and Description
public static boolean	Returns: `true` if the strings are equal to each other, `false` otherwise. equals(final String The first string to compare. s1, final String The second string to compare. s2, final boolean `true` if the strings should be compared without regard to case. Note that "true" here is only guaranteed to work with plain ASCII characters. ignoreCase) Implements String equality which always compares all characters in the string, without stopping early if any characters do not match.
public static boolean	Returns: `true` if the arrays are equal to each other, `false` otherwise. equals(final byte[] The first array to compare. b1, final byte[] The second array to compare. b2) Implements byte-array equality which always compares all bytes in the array, without stopping early if any bytes do not match.
public abstract String	Returns: the algorithm used to convert input credentials to stored credentials. getAlgorithm()
protected abstract int	Returns: the default number of iterations used by the `CredentialHandler`. getDefaultIterations()
protected int	Returns: the default salt length used by the `CredentialHandler`. getDefaultSaltLength()
public int	Returns: the number of iterations of the associated algorithm that will be used when creating a new stored credential for a given input credential. getIterations()
protected abstract Log	Returns: the logger for the CredentialHandler instance. getLog()
public boolean	Returns: `true` if logging will occur getLogInvalidStoredCredentials() When checking input credentials against stored credentials will a warning message be logged if invalid stored credentials are discovered?
public int	Returns: the salt length that will be used when creating a new stored credential for a given input credential. getSaltLength()
private void	logInvalidStoredCredentials(String storedCredentials)
protected boolean	Returns: `true` if they match, otherwise `false` matchesSaltIterationsEncoded(String The input credential inputCredentials, String The stored credential storedCredentials) Checks whether the provided credential matches the stored credential when the stored credential is in the form salt$iteration-count$credential
public String	mutate(String User provided credentials userCredential) Implements org.apache.catalina.CredentialHandler.mutate. Generates the equivalent stored credentials for the given input credentials.
protected abstract String	Returns: The equivalent stored credentials for the given input credentials or `null` if the generation fails mutate(String User provided credentials inputCredentials, byte[] Salt, if any salt, int Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials iterations) Generates the equivalent stored credentials for the given input credentials, salt and iterations.
protected String	Returns: The equivalent stored credentials for the given input credentials or `null` if the generation fails mutate(String User provided credentials inputCredentials, byte[] Salt, if any salt, int Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials iterations, int Length of the produced digest in bits for implementations where it's applicable keyLength) Generates the equivalent stored credentials for the given input credentials, salt, iterations and key length.
public abstract void	setAlgorithm(String the algorithm algorithm) Set the algorithm used to convert input credentials to stored credentials.
public void	setIterations(int the iterations count iterations) Set the number of iterations of the associated algorithm that will be used when creating a new stored credential for a given input credential.
public void	setLogInvalidStoredCredentials(boolean `true` to log, the default value is `false` logInvalidStoredCredentials) Set whether a warning message will be logged if invalid stored credentials are discovered while checking input credentials against stored credentials?
public void	setSaltLength(int the salt length saltLength) Set the salt length that will be used when creating a new stored credential for a given input credential.

Inherited from java.lang.Object:: clone equals finalize getClass hashCode notify notifyAll toString wait wait wait

DEFAULT_SALT_LENGTH	back to summary
public static final int DEFAULT_SALT_LENGTH

iterations	back to summary
private int iterations

logInvalidStoredCredentials	back to summary
private boolean logInvalidStoredCredentials

random	back to summary
private volatile Random random

randomLock	back to summary
private final Object randomLock

saltLength	back to summary
private int saltLength

sm	back to summary
protected static final StringManager sm

DigestCredentialHandlerBase	back to summary
public DigestCredentialHandlerBase()

Method Detail

equals back to summary

equals	back to summary
public static boolean equals(final String s1, final String s2, final boolean ignoreCase) Implements String equality which always compares all characters in the string, without stopping early if any characters do not match. Note This implementation was adapted from `MessageDigest#isEqual` which we assume is as optimizer-defeating as possible. Parameters s1:String The first string to compare. s2:String The second string to compare. ignoreCase:boolean `true` if the strings should be compared without regard to case. Note that "true" here is only guaranteed to work with plain ASCII characters. Returns:boolean `true` if the strings are equal to each other, `false` otherwise.

public static boolean equals(final String s1, final String s2, final boolean ignoreCase)

Implements String equality which always compares all characters in the string, without stopping early if any characters do not match.

Note

This implementation was adapted from MessageDigest#isEqual which we assume is as optimizer-defeating as possible.

Parameters

s1:String: The first string to compare.
s2:String: The second string to compare.
ignoreCase:boolean: true if the strings should be compared without regard to case. Note that "true" here is only guaranteed to work with plain ASCII characters.

Returns:boolean

true if the strings are equal to each other, false otherwise.

equals back to summary

equals	back to summary
public static boolean equals(final byte[] b1, final byte[] b2) Implements byte-array equality which always compares all bytes in the array, without stopping early if any bytes do not match. Note Implementation note: this method delegates to `MessageDigest#isEqual` under the assumption that it provides a constant-time comparison of the bytes in the arrays. Java 7+ has such an implementation, but neither the Javadoc nor any specification requires it. Therefore, Tomcat should continue to use this method internally in case the JDK implementation changes so this method can be re-implemented properly. Parameters b1:byte[] The first array to compare. b2:byte[] The second array to compare. Returns:boolean `true` if the arrays are equal to each other, `false` otherwise.

public static boolean equals(final byte[] b1, final byte[] b2)

Implements byte-array equality which always compares all bytes in the array, without stopping early if any bytes do not match.

Note

Implementation note: this method delegates to MessageDigest#isEqual under the assumption that it provides a constant-time comparison of the bytes in the arrays. Java 7+ has such an implementation, but neither the Javadoc nor any specification requires it. Therefore, Tomcat should continue to use this method internally in case the JDK implementation changes so this method can be re-implemented properly.

Parameters

b1:byte[]: The first array to compare.
b2:byte[]: The second array to compare.

Returns:boolean

true if the arrays are equal to each other, false otherwise.

getAlgorithm	back to summary
public abstract String getAlgorithm() Returns:String the algorithm used to convert input credentials to stored credentials.

getDefaultIterations	back to summary
protected abstract int getDefaultIterations() Returns:int the default number of iterations used by the `CredentialHandler`.

getDefaultSaltLength	back to summary
protected int getDefaultSaltLength() Returns:int the default salt length used by the `CredentialHandler`.

getIterations	back to summary
public int getIterations() Returns:int the number of iterations of the associated algorithm that will be used when creating a new stored credential for a given input credential.

getLog	back to summary
protected abstract Log getLog() Returns:Log the logger for the CredentialHandler instance.

getLogInvalidStoredCredentials back to summary

getLogInvalidStoredCredentials	back to summary
public boolean getLogInvalidStoredCredentials() When checking input credentials against stored credentials will a warning message be logged if invalid stored credentials are discovered? Returns:boolean `true` if logging will occur

public boolean getLogInvalidStoredCredentials()

When checking input credentials against stored credentials will a warning message be logged if invalid stored credentials are discovered?

Returns:boolean: true if logging will occur

getSaltLength	back to summary
public int getSaltLength() Returns:int the salt length that will be used when creating a new stored credential for a given input credential.

logInvalidStoredCredentials	back to summary
private void logInvalidStoredCredentials(String storedCredentials)

matchesSaltIterationsEncoded back to summary

matchesSaltIterationsEncoded	back to summary
protected boolean matchesSaltIterationsEncoded(String inputCredentials, String storedCredentials) Checks whether the provided credential matches the stored credential when the stored credential is in the form salt$iteration-count$credential Parameters inputCredentials:String The input credential storedCredentials:String The stored credential Returns:boolean `true` if they match, otherwise `false`

protected boolean matchesSaltIterationsEncoded(String inputCredentials, String storedCredentials)

Checks whether the provided credential matches the stored credential when the stored credential is in the form salt$iteration-count$credential

Parameters

inputCredentials:String: The input credential
storedCredentials:String: The stored credential

Returns:boolean

true if they match, otherwise false

mutate	back to summary
public String mutate(String userCredential) Implements org.apache.catalina.CredentialHandler.mutate. Doc from org.apache.catalina.CredentialHandler.mutate. Generates the equivalent stored credentials for the given input credentials. Parameters userCredential:String User provided credentials Returns:String The equivalent stored credentials for the given input credentials Annotations @Override

mutate

back to summary

public String mutate(String userCredential)

Implements org.apache.catalina.CredentialHandler.mutate.

Doc from org.apache.catalina.CredentialHandler.mutate.

Generates the equivalent stored credentials for the given input credentials.

Parameters

userCredential:String: User provided credentials

Returns:String

The equivalent stored credentials for the given input credentials

Annotations

@Override

mutate back to summary

mutate	back to summary
protected abstract String mutate(String inputCredentials, byte[] salt, int iterations) Generates the equivalent stored credentials for the given input credentials, salt and iterations. If the algorithm requires a key length, the default will be used. Parameters inputCredentials:String User provided credentials salt:byte[] Salt, if any iterations:int Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials Returns:String The equivalent stored credentials for the given input credentials or `null` if the generation fails

protected abstract String mutate(String inputCredentials, byte[] salt, int iterations)

Generates the equivalent stored credentials for the given input credentials, salt and iterations. If the algorithm requires a key length, the default will be used.

Parameters

inputCredentials:String: User provided credentials
salt:byte[]: Salt, if any
iterations:int: Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials

Returns:String

The equivalent stored credentials for the given input credentials or null if the generation fails

mutate back to summary

mutate	back to summary
protected String mutate(String inputCredentials, byte[] salt, int iterations, int keyLength) Generates the equivalent stored credentials for the given input credentials, salt, iterations and key length. The default implementation calls ignores the key length and calls `mutate(String, byte[], int)`. Sub-classes that use the key length should override this method. Parameters inputCredentials:String User provided credentials salt:byte[] Salt, if any iterations:int Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials keyLength:int Length of the produced digest in bits for implementations where it's applicable Returns:String The equivalent stored credentials for the given input credentials or `null` if the generation fails

protected String mutate(String inputCredentials, byte[] salt, int iterations, int keyLength)

Generates the equivalent stored credentials for the given input credentials, salt, iterations and key length. The default implementation calls ignores the key length and calls mutate(String, byte[], int). Sub-classes that use the key length should override this method.

Parameters

inputCredentials:String: User provided credentials
salt:byte[]: Salt, if any
iterations:int: Number of iterations of the algorithm associated with this CredentialHandler applied to the inputCredentials to generate the equivalent stored credentials
keyLength:int: Length of the produced digest in bits for implementations where it's applicable

Returns:String

The equivalent stored credentials for the given input credentials or null if the generation fails

setAlgorithm	back to summary
public abstract void setAlgorithm(String algorithm) throws NoSuchAlgorithmException Set the algorithm used to convert input credentials to stored credentials. Parameters algorithm:String the algorithm Exceptions NoSuchAlgorithmException: if the specified algorithm is not supported

setAlgorithm

back to summary

public abstract void setAlgorithm(String algorithm) throws NoSuchAlgorithmException

Set the algorithm used to convert input credentials to stored credentials.

Parameters

algorithm:String: the algorithm

Exceptions

NoSuchAlgorithmException:: if the specified algorithm is not supported

setIterations	back to summary
public void setIterations(int iterations) Set the number of iterations of the associated algorithm that will be used when creating a new stored credential for a given input credential. Parameters iterations:int the iterations count

setIterations

back to summary

public void setIterations(int iterations)

Set the number of iterations of the associated algorithm that will be used when creating a new stored credential for a given input credential.

Parameters

iterations:int: the iterations count

setLogInvalidStoredCredentials back to summary

setLogInvalidStoredCredentials	back to summary
public void setLogInvalidStoredCredentials(boolean logInvalidStoredCredentials) Set whether a warning message will be logged if invalid stored credentials are discovered while checking input credentials against stored credentials? Parameters logInvalidStoredCredentials:boolean `true` to log, the default value is `false`

public void setLogInvalidStoredCredentials(boolean logInvalidStoredCredentials)

Set whether a warning message will be logged if invalid stored credentials are discovered while checking input credentials against stored credentials?

Parameters

logInvalidStoredCredentials:boolean: true to log, the default value is false

setSaltLength	back to summary
public void setSaltLength(int saltLength) Set the salt length that will be used when creating a new stored credential for a given input credential. Parameters saltLength:int the salt length

setSaltLength

back to summary

public void setSaltLength(int saltLength)

Set the salt length that will be used when creating a new stored credential for a given input credential.

Parameters

saltLength:int: the salt length

public abstract Class DigestCredentialHandlerBase

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail