How to add support for hashed password

Flowable Engine
1

Hi,

I’ve seen some old post that debate on the flowable passwords being in clear text in the act_id_user table.
Password should never be stored user password in clear text no matter what (https or not).

Is someone have successfully implemented the persistence of the hashed password and provide the classes details that need to be changed?

I’ve been looking in that section and it is not clear to me on how to set that passwordEncoder in the following documentation.

Any helps would be appreciated.

Thank you.

1 Like
2

Hi Prioux.

From doc:

By default, the user passwords will be saved in plain text in the IDM database tables. To make sure that the passwords are encoded you can define a password encoder in the process engine configuration.

If you want to store encoded passwords change default idm configuration (which uses ClearTextPasswordEncoder) to other password encoder. e.g.

<bean id="bCryptEncoder"
class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

<bean id="passwordEncoder" class="org.flowable.idm.spring.authentication.SpringEncoder">
    <constructor-arg ref="bCryptEncoder"/>
</bean>

<bean id="processEngineConfiguration" class="org.flowable.engine.impl.cfg.StandaloneInMemProcessEngineConfiguration">
  <property name="passwordEncoder" ref="passwordEncoder" />
  ...
</bean>
3

In which file this bean section is going to? There is so many folders and and I am not sure where this section need to go.

4

As additional information, we are using an old version 6.3.1 and spring.

Setting the following to a flowable.cfg.xml file under flowable-idm (webapps\flowable-idm\WEB-INF\classes) or flowable-rest (webapps\flowable-rest\WEB-INF\classes) class path have no effect.

<?xml version="1.0" encoding="UTF-8"?>

<beans xmlns="http://www.springframework.org/schema/beans"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.springframework.org/schema/beans   http://www.springframework.org/schema/beans/spring-beans.xsd">
  
    <bean id="processEngineConfiguration" class="org.flowable.spring.SpringProcessEngineConfiguration">
        <property name="passwordEncoder" ref="passwordEncoder" />
    </bean>

    <bean id="bCryptEncoder"
          class="org.springframework.security.crypto.bcrypt.BCryptPasswordEncoder"/>

    <bean id="passwordEncoder" class="org.flowable.idm.spring.authentication.SpringEncoder">
        <constructor-arg ref="bCryptEncoder"/>
    </bean>

</beans>