Set up a session with alfresco using a password hash

As we transition to the new Hyland Community, some post links may be temporarily disrupted as we finalize redirects. We apologize for the inconvenience and are working to resolve this as quickly as possible. Details.

viktoriyamoskov

Good day.

I am developing a Java application that uses OpenCMIS to communicate with the Alfresco repository. Is it possible to set up a session with the Alfresco repository using a password hash? For example,
parameter.put (SessionParameter.USER, userName);
parameter.put (SessionParameter.PASSWORD, passwordHash);
And do not store it in clear?

afaust

No, it is not. Password hashing is supported by Alfresco, but it happens on the server-side for validation of provided passwords, and is not supported for parameters for creating the CMIS session. I also do not see how that would solve your issue - instead of storing the password in the clear, you would be storing the hash in the clear, which would grant any attacker as much access to Aflresco as if they had the password.

What you can do with Alfresco is the following:

• log in separately from CMIS using the ReST API (using user name / password as in CMIS session setup)
• Obtain a "ticket" via the ReST API
• Use the ticket to authenticate in the CMIS session setup

A ticket is a runtime token linked to the user, and automatically expires after a (configurable) time of inactivity. If a ticket is obtained by an attacker, it would not fully compromise the user, as it would only be limited for a certain amount of time, and any explicit logout of / by the user would also invalidate the ticket. It would also not compromise the user on other systems where they potentially use the same password.