Here is my shiro config
[main]
authc.loginUrl = /site/index.jsp
authc.usernameParam = user
authc.passwordParam = pass
authc.rememberMeParam = remember
authc.successUrl = /site/home.jsp
jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.permissionsLookupEnabled=true
jdbcRealm.authenticationQuery = select password from users where username = ?
jdbcRealm.userRolesQuery = select role from users where username = ?
credentialsMatcher = org.apache.shiro.authc.credential.HashedCredentialsMatcher
credentialsMatcher.hashAlgorithmName = SHA-256
credentialsMatcher.storedCredentialsHexEncoded = true
credentialsMatcher.hashIterations = 5000
jdbcRealm.credentialsMatcher = $credentialsMatcher
jof = org.apache.shiro.jndi.JndiObjectFactory
jof.resourceName = jdbc/postgres
jof.requiredType = javax.sql.DataSource
jof.resourceRef = true
jdbcRealm.dataSource = $jof
securityManager.realms = jdbcRealm
[urls]
/theme/** = anon
/site/** = authc
/site/cards.jsp = roles[smoto,admin]
/site/jobs.jsp = roles[admin]
I created the hash like this for admin password admin
String hashedPassword = new Sha256Hash("admin", "",5000).toHex();
I inserted the hash into the db but my authentication fails every time, does anyone have any experience with this kind of setup with shiro? Also how would I enable debugging or logging for shiro?
EDIT: here is the correct set up for this kind of authentication, found it in another stackoverflow post
[main]
authc.loginUrl = /site/index.jsp
authc.usernameParam = user
authc.passwordParam = pass
authc.rememberMeParam = remember
authc.successUrl = /site/home.jsp
jdbcRealm=org.apache.shiro.realm.jdbc.JdbcRealm
jdbcRealm.permissionsLookupEnabled=false
jdbcRealm.authenticationQuery = select password from users where username = ?
jdbcRealm.userRolesQuery = select role from users where username = ?
ps = org.apache.shiro.authc.credential.DefaultPasswordService
pm = org.apache.shiro.authc.credential.PasswordMatcher
pm.passwordService = $ps
jof = org.apache.shiro.jndi.JndiObjectFactory
jof.resourceName = jdbc/postgres
jof.requiredType = javax.sql.DataSource
jof.resourceRef = true
jdbcRealm.dataSource = $jof
jdbcRealm.credentialsMatcher = $pm
#securityManager.realms = jdbcRealm
[urls]
/theme/** = anon
/site/** = authc
/site/cards.jsp = roles[smoto,admin]
/site/jobs.jsp = roles[admin]
The trick is to use the hashing tool that shiro provides and copy the exact output into database field "password", the whole string will contain info on what algorithm is used how many iteration etc, example:
$shiro1$SHA-256$500000$salthere$hashhere