如何在Quarkus/Wildfly中验证/比较/euqal BCrypt散列密码与给定密码

Question

我已经使用带有JPA的安全性实现了basic auth。我的所有RESTendpoint现在都可以验证客户端请求的authorization头。密码的验证由框架完成。现在我需要能够验证一个密码与存储的密码哈希。

在默认配置下，用户密码以散列形式存储，并使用bcryptutil.bcryptHash（字符串密码）函数。如何检查给定的密码字符串是否与存储的bcrypt哈希值匹配？

• 来源:https://quarkus.io/guides/security-jpa

Answer 1

我编写了一个小实用程序类，它用bycrpt密码哈希验证密码字符串。

import org.wildfly.security.password.Password;
import org.wildfly.security.password.PasswordFactory;
import org.wildfly.security.password.WildFlyElytronPasswordProvider;
import org.wildfly.security.password.interfaces.BCryptPassword;
import org.wildfly.security.password.util.ModularCrypt;

import io.quarkus.elytron.security.common.BcryptUtil;

public class SecurityUtil {

    public static void main(String[] args) throws Exception {

        String bCryptPasswordHash = BcryptUtil.bcryptHash("Password_1");
        String passwordToVerify = "Password_1";

        System.out.println(verifyBCryptPassword(bCryptPasswordHash, passwordToVerify)); // -> true

        System.out.println(verifyBCryptPassword(bCryptPasswordHash, "NotPassword_1")); // --> false

    }

    public static boolean verifyBCryptPassword(String bCryptPasswordHash, String passwordToVerify) throws Exception {

        WildFlyElytronPasswordProvider provider = new WildFlyElytronPasswordProvider();

        // 1. Create a BCrypt Password Factory
        PasswordFactory passwordFactory = PasswordFactory.getInstance(BCryptPassword.ALGORITHM_BCRYPT, provider);

        // 2. Decode the hashed user password
        Password userPasswordDecoded = ModularCrypt.decode(bCryptPasswordHash);

        // 3. Translate the decoded user password object to one which is consumable by this factory.
        Password userPasswordRestored = passwordFactory.translate(userPasswordDecoded);

        // Verify existing user password you want to verify
        return passwordFactory.verify(userPasswordRestored, passwordToVerify.toCharArray());

    }
}