Spring Security 3 SHA-1 with Salt

Question

I have a legacy application that we are rewriting and I am in the process of converting the existing user table. The passwords were encrypted by using sha-1 with a salt. Specifically salt+password. Example, if the salt is ABC123 and the password is XYZ789 then the string that would be encrypted is ABC123XYZ789. Spring Security by default encrypts the String XYZ789{ABC123}. How do implement my own password encrypt/validation to bypass Spring Security's default encryption.

I can post my security xml but everything is working if I update the hashed password with the password{salt} encrypted.

Thanks for you help!

Answer 1

Subclass ShaPasswordEncoder and override the mergePasswordAndSalt(String, Object, boolean) method. You can see here, how it is originally implemented. Just modify the string concatenation part, and you are done.

Then, provide your own passwordEncoder like this:

<beans:bean 
    id="passwordEncoder" 
    class="my.awesome.package.MyAwesomeShaPasswordEncoder"/>