How to migrate accounts with passwords hashed using SHA-256 1Iteration in grails 2.5.6 to Grails 4.0.12 - grails

Question

I recently started my attempts at updating this application from Grails 2.5.6 to Grails 4.0.12. I am very new to grails and programming in general so it has been 3 weeks and hundreds of attempts with no success. Everything seems to work fine except the password hashing. Since the passwords were hashed using SHA256 users are unable to login. I've tried various implementations from the internet but sadly none of them worked, so stackoverflow is my last attempt. However, just for context, no errors are thrown in the case anyone wonders; but at the same time if you are asking for any exceptions than you probably don't know how to solve it:(. Well, thanks to anyone that has any tips.
I have tried creating a Sha256 to BCrypt encoder as described by Burt Beckwith here but with no success. That approach doesn't seem tow work for my case.

Answer 1

For those that might encounter this issue, I wrote a very interesting approach.
Grails 4 provides a feature that allows custom encoder (codec) implementation as long as the class is under the utils folder and the class name should end with Codec, i.e. class MyEncoderCodec. read more about this here.
So for those using SHA-256 with 1 iteration, the solution is the following:
Create the encoder
//path grails-app/Utils/OldEncoderCodec.groovy
import java.security.MessageDigest
class OldEncoderCodec {
static encode = { String rawPass ->
MessageDigest md = MessageDigest.getInstance("SHA-256")
md.update(rawPass.getBytes())
byte[] byteData = md.digest()
//convert the byte to hex format - test1
StringBuffer sb = new StringBuffer()
for (int i = 0; i < byteData.length; i++) {
sb.append(Integer.toString((byteData[i] & 0xff) + 0x100, 16).substring(1))
}
return sb.toString()
}
}
Create a controller method to handle the conversion.
import app.Appuser
import grails.converters.JSON
import grails.gorm.transactions.Transactional
import grails.plugin.springsecurity.annotation.Secured
class HelpController {
def springSecurityService
#Transactional
def ajaxEncodeAndUpdatePasswords(){
def username = request.getJSON().u
def rawPass = request.getJSON().p
boolean result = true //I am always returning true, so handle this as you need to; i.e. you could return false if the user was not found and display a message on the form instead of submitting.
def u = Appuser.findByUsername(username)
if(u){
def dbPass = u.password
if(!dbPass.startsWith("{")) {
def encodedPass = rawPass.encodeAsOldEncoder()
if(dbPass == encodedPass){
u.password = rawPass
u.save(flush: true)
}
}
}
render ([result:result] as JSON)
}
}
Use ajax to perform conversion before the form submission; You could use interceptors but I think an ajax call is cleaner and you can avoid overriding and dependency injections. I'm new to programming so I know that this javascript code could be improved. Also note that in my case #login-button is the submit button that submits my form; handling enter key as well.
//path views/login/auth.gsp
$(document).ready(function(){
$('#login-button').on('click', function(event){
event.preventDefault();
nCode()
});
$(window).keydown(function(event){
if(event.keyCode === 13) {
event.preventDefault();
nCode()
}
});
function nCode(){
const u=$('#username').val()
const p=$('#password').val()
$.ajax({
url:'${createLink(controller: 'help', action: 'ajaxEncodeAndUpdatePasswords')}',
contentType:'json',
method:'POST',
data: JSON.stringify({
u:u,
p:p
})
}).done((data)=>{
$('#loginForm').submit()
})
}
I am not using the encoder to authenticate users, only to check for a match, then I am just updating the user's password in the database and letting spring security handle the encoding. Hope someone finds this useful.