org.keycloak.models.utils

Class Pbkdf2PasswordEncoder

java.lang.Object

org.keycloak.models.utils.Pbkdf2PasswordEncoder

public class Pbkdf2PasswordEncoder
extends Object

Encoder that uses PBKDF2 function to cryptographically derive passwords.

Passwords are returned with a Base64 encoding.

Author:

Bruno Oliveira

Field Summary

Fields

Modifier and Type	Field and Description
static String	PBKDF2_ALGORITHM
static String	RNG_ALGORITHM

Constructor Summary

Constructors

Constructor and Description
Pbkdf2PasswordEncoder(byte[] salt)
Pbkdf2PasswordEncoder(byte[] salt, int iterations)

Method Summary

Methods

Modifier and Type	Method and Description
String	encode(String rawPassword)
String	encode(String rawPassword, int iterations) Encode the raw password provided
static byte[]	getSalt() Generate a salt for each password
boolean	verify(String rawPassword, String encodedPassword) Encode the password provided and compare with the hash stored into the database
boolean	verify(String rawPassword, String encodedPassword, int iterations) Encode the password provided and compare with the hash stored into the database

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PBKDF2_ALGORITHM

public static final String PBKDF2_ALGORITHM

See Also:

Constant Field Values

RNG_ALGORITHM

public static final String RNG_ALGORITHM

See Also:

Constant Field Values

Constructor Detail

Pbkdf2PasswordEncoder

public Pbkdf2PasswordEncoder(byte[] salt,
                     int iterations)

Pbkdf2PasswordEncoder

public Pbkdf2PasswordEncoder(byte[] salt)

Method Detail

encode

public String encode(String rawPassword,
            int iterations)

Encode the raw password provided

Parameters:

rawPassword - The password used as a master key to derive into a session key

Returns:

encoded password in Base64

encode

public String encode(String rawPassword)

verify

public boolean verify(String rawPassword,
             String encodedPassword)

Encode the password provided and compare with the hash stored into the database

Parameters:

rawPassword - The password provided

encodedPassword - Encoded hash stored into the database

Returns:

true if the password is valid, otherwise false for invalid credentials

verify

public boolean verify(String rawPassword,
             String encodedPassword,
             int iterations)

Encode the password provided and compare with the hash stored into the database

Parameters:

rawPassword - The password provided

encodedPassword - Encoded hash stored into the database

Returns:

true if the password is valid, otherwise false for invalid credentials

getSalt

public static byte[] getSalt()

Generate a salt for each password

Returns:

cryptographically strong random number