Storing User Passwords Securely (A.E) planned?

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

udoderk

Hi Activiti Core Team,

now i'm found, that the user passwords are stored as plain text. The Storage in this way is not a good solution (as well as store a "one-way hash" , "salt" the password before hashing, PER_USER_SALT + password - thay are bad solutions)
Are you planning the securely storing of the user passwords using jBCrypt, scrypt or Shiro or other security solutions?

If we want to implement the more Securely solutions like using jBcrypt for Activiti Explorer, what steps are needed?
i know currently the step number zero : set the library like jBcrypt to the java class path
i suppose, that i need to implement own identity service (like following descriptions (1, 2)


Thanks

frederikherema1

The explorer-app is intended as a "demo app",  a good place to start. This is the reason why we're not putting in effort for password-encryption because this depends on the required implementation.

I'm not sure how that mechanism works you're suggesting, but if you get a piece of text in the end, that you can store as a password using the API. This would only require changing parts of the Activiti-explorer (user-creation and authentication) which is less drastically than altering user-management. If it's a more complex approach, you'll have to override the identity-stuff, indeed.