We are just migrating our custom Wildfly login module to Elytron. I successfully created the new custom security realm and the authentication works fine. Now we have a customer ticket, that the login password has to be encoded on the client side before sending to the server. I use a servlet to generate a random key and sending it back to the client every time the user press the Login button. Then I encode the password using that key and submit the form. At this point the question is, how could I get that random key in the custom security realm module, that I could decode the password in the verifyEvidence method?
A stateful store for a secret used for password decryption in an Elytron custom security realm
Viewed 42
1 Answers
if I understood your question well, then your servlet can store the generated key in some storage or datasource. Your custom security realm can then retrieve it during the verification of evidence provided by client.
Related