Corrected password hash & salt sharing logic.

Signed-off-by: Mahammed Taheer <[email protected]>
mosip · Nov 24, 2023 · 7f46153 · 7f46153
1 parent 8e265d5
commit 7f46153
Show file tree

Hide file tree

Showing 3 changed files with 16 additions and 4 deletions.
diff --git a/...main/java/io/mosip/authentication/common/service/impl/match/PasswordMatchingStrategy.java b/...main/java/io/mosip/authentication/common/service/impl/match/PasswordMatchingStrategy.java
@@ -1,8 +1,11 @@
 package io.mosip.authentication.common.service.impl.match;
 
 import static io.mosip.authentication.core.constant.IdAuthCommonConstants.SEMI_COLON;
+import static io.mosip.authentication.core.constant.IdAuthCommonConstants.COLON;
 
+import java.util.Arrays;
 import java.util.Map;
+import java.util.stream.Collectors;
 
 import io.mosip.authentication.core.constant.IdAuthCommonConstants;
 import io.mosip.authentication.core.constant.IdAuthenticationErrorConstants;
@@ -24,9 +27,13 @@ public enum PasswordMatchingStrategy implements MatchingStrategy {
                 ComparePasswordFunction func = (ComparePasswordFunction) object;
                 Map<String, String> entityInfoMap = (Map<String, String>) entityInfo;
                 Map<String, String> reqInfoMap = (Map<String, String>) reqInfo;
-                String[] hashSaltValue = entityInfoMap.get("password").split(SEMI_COLON);
-                String passwordHashedValue = hashSaltValue[0];
-                String salt = hashSaltValue[1];
+                String hashSaltValue = entityInfoMap.get(IdaIdMapping.PASSWORD.getIdname());
+                Map<String, String> passwordMap = Arrays.stream(hashSaltValue.split(SEMI_COLON))
+                                                        .map(str -> str.split(String.valueOf(COLON), 2))
+        						                        .collect(Collectors.toMap(strArr -> strArr[0].trim(), strArr -> strArr[1].trim()));
+
+                String passwordHashedValue = passwordMap.get(IdAuthCommonConstants.HASH);
+                String salt = passwordMap.get(IdAuthCommonConstants.SALT);
                 String reqInfoValue = reqInfoMap.get(IdaIdMapping.PASSWORD.getIdname());
 				boolean matched = func.matchPasswordFunction(reqInfoValue, passwordHashedValue, salt);
                 return !matched ? 0 : 100;

diff --git a/...ation-core/src/main/java/io/mosip/authentication/core/constant/IdAuthCommonConstants.java b/...ation-core/src/main/java/io/mosip/authentication/core/constant/IdAuthCommonConstants.java
@@ -449,6 +449,8 @@ public final class IdAuthCommonConstants {
 
 	public static final String PASSWORD = "password";
 
+	public static final String SALT = "salt";
+
 	public static final String SEMI_COLON = ";";
 
 	private IdAuthCommonConstants() {

diff --git a/...tion-core/src/main/java/io/mosip/authentication/core/spi/indauth/match/IdInfoFetcher.java b/...tion-core/src/main/java/io/mosip/authentication/core/spi/indauth/match/IdInfoFetcher.java
@@ -2,6 +2,7 @@
 
 import static io.mosip.authentication.core.constant.IdAuthCommonConstants.PASSWORD;
 import static io.mosip.authentication.core.constant.IdAuthCommonConstants.SEMI_COLON;
+import static io.mosip.authentication.core.constant.IdAuthCommonConstants.COLON;
 
 import java.util.Collections;
 import java.util.List;
@@ -239,7 +240,9 @@ public static Map<String, List<IdentityInfoDTO>> getIdInfo(Map<String, Object> i
 				return Stream.of(idInfo).collect(Collectors.toList());
 			} else if (entry.getKey().equals(PASSWORD) && val instanceof Map) {
 				Map<String, String> map = (Map<String, String>) val;
-				String passwordData = map.entrySet().stream().map(mapEntry -> mapEntry.getValue() ).collect(Collectors.joining(SEMI_COLON));
+				String passwordData = map.entrySet().stream()
+										 .map(mapEntry -> mapEntry.getKey().trim() + String.valueOf(COLON) + mapEntry.getValue().trim())
+										 .collect(Collectors.joining(SEMI_COLON));
 				IdentityInfoDTO idInfo = new IdentityInfoDTO();
 				idInfo.setValue(String.valueOf(passwordData));
 				return Stream.of(idInfo).collect(Collectors.toList());