com.cleo.security.hashing

Interface Authenticator

public interface Authenticator

The Authenticator interface defines a custom scheme for verifying user credentials. An implementation of the interface can be used to migrate users and their credentials from another system without requiring the user to reset their password right away. Subsequently, once a user's password is eventually reset within VersaLex (by either the user or an administrator), the authentication scheme will transition automatically to VersaLex's default scheme. The default scheme is vlpbdf2 and is formatted as vlpbdf2:iteration:salt:hash. The expectation is that a custom scheme is also some type of hashed password.

To activate a custom authentication scheme:

• Copy the custom class jar to the VersaLex lib/api directory
• Using either the conf/system.properties file or a JVM -D parameter, set the following system property: cleo.password.validator.myscheme=com.company.MyScheme where myscheme is the scheme name and com.company.MyScheme is the fully-qualified class name of the scheme's implementation
• Restart the VersaLex service/daemon

Once the authentication scheme has been activated, the final step is to migrate over the FTP, SFTP, and/or HTTP local user mailboxes and their credentials. This can be done using ILexiCom.create(int, java.lang.String[]) to create mailboxes. The mailbox "pwdhash" property must be set to the value that corresponds to the custom scheme. This can be done using ILexiCom.setProperty(int, java.lang.String[], java.lang.String, java.lang.String). The value must begin with the scheme name followed by a colon (:). The expectation is that any other fields within the value are also separated by colons, but this is not a requirement. The full value including the scheme name is passed to the authenticator.

Method Summary

Modifier and Type	Method and Description
default java.lang.String	getPreviousSchemeName() Returns the name of the previous scheme that was used
java.lang.String	getSchemeName() Returns the name of the scheme
boolean	verify(java.lang.String username, java.lang.String password, java.lang.String hashScheme) Verifies the username and password are valid with the given scheme:iterations:salt:hash.

Method Detail

verify

boolean verify(java.lang.String username,
               java.lang.String password,
               java.lang.String hashScheme)

Verifies the username and password are valid with the given scheme:iterations:salt:hash.

Parameters:

username - username

password - user-provided password to verify

hashScheme - previously set hashed password for user - always starts with scheme:

Returns:

true if the authentication succeeds

getSchemeName

java.lang.String getSchemeName()

Returns the name of the scheme

Returns:

the scheme name

getPreviousSchemeName

default java.lang.String getPreviousSchemeName()

Returns the name of the previous scheme that was used

Returns:

the previous (deprecated) scheme name