Jasypt with spring 4.0 - spring-security

Question

I am using spring security in my application through XML configuration.
This is my password encoder bean
<b:bean id="passwordEncoder"
class="org.springframework.security.crypto.password.StandardPasswordEncoder">
<b:constructor-arg value="ThisIsASecretSoChangeMe" />
</b:bean>
I want to replace it with Jasypt encryption.
How to integrate jasypt 1.9 with spring security 4.0.1.RELEASE?

Answer 1

If you are using spring-boot use this dependeny in pom
<dependency>
<groupId>com.github.ulisesbocchio</groupId>
<artifactId>jasypt-spring-boot-starter</artifactId>
<version>${jasypt-spring-boot-starter.version}</version>
</dependency>
and in your application.yml or application.properties file just put the Encrypted password enclosed with ENC() instead of plainpassword. Example
password:
encrypted:
password: ENC(nZ3U2bdJ05FHp1LYQbAVvDKkVs8Pi3Ke)
jasypt:
encryptor:
password: IfYouAreGoodAtSomethingNeverDoItForFree
Before this you need to generate this encrypted password from your plaintext password and the jasypt.encryptor.password(similar to salt, in this case IfYouAreGoodAtSomethingNeverDoItForFree). This can be done by something like this
java -cp ~/.m2/repository/org/jasypt/jasypt/1.9.2/jasypt-1.9.2.jar org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI input="PasswordToBeEncrypted" password=<SecretKeyToEncryptDecrypt> algorithm=PBEWithMD5AndDES
or torough a java code. Here is a rough draft.
public class Md5Test {
public static void main(String[] args) throws NoSuchAlgorithmException {
String password = "plaintextpassword";
BasicTextEncryptor textEncryptor = new BasicTextEncryptor();
textEncryptor.setPassword("IfYouAreGoodAtSomethingNeverDoItForFree ");
String myEncryptedText = textEncryptor.encrypt(password);
System.out.println(myEncryptedText);
BasicTextEncryptor textDecryptor = new BasicTextEncryptor();
textDecryptor.setPassword("IfYouAreGoodAtSomethingNeverDoItForFree ");
String plainText = textDecryptor.decrypt("QBPaH8HKE8JDaeIpJk66Kc8nGHtBfY+L");
System.out.println(plainText);
}
}

Answer 2

generated encrypted string from command does not give desired result as it can not encrypt special chards like "!".and gives error "event not found"
KAD#ashutosh MINGW64 ~/Desktop
$ java -cp
~/.m2/repository/org/jasypt/jasypt/1.9.3/jasypt-1.9.3.jar
org.jasypt.intf.cli.JasyptPBEStringEncryptionCLI
input="Test!email30#password" password="some_salt"
algorithm=PBEWithMD5AndDES
bash: !email30#password: event not found
Here is an example using org.jasypt.util.text.AES256TextEncryptor
This is a utility class for easily performing high-strength encryption of texts.
This class internally holds a StandardPBEStringEncryptor configured this way:
Algorithm: PBEWithHMACSHA512AndAES_256.
Key obtention iterations: 1000.
The required steps to use it are:
Create an instance (using new).
Set a password (using setPassword(String) or setPasswordCharArray(char[])).
Perform the desired encrypt(String) or decrypt(String) operations.
pom.xml:
<dependency>
<groupId>com.github.ulisesbocchio</groupId>
<artifactId>jasypt-spring-boot-starter</artifactId>
<version>2.1.2</version>
</dependency>
You can use jasypt latest 2.1.2(with boot 2.1.1) or jasypt-1.9.3.jar.
Java Code:
import org.jasypt.util.text.AES256TextEncryptor;
import java.security.NoSuchAlgorithmException;
public class JasyptPasswordEcryptor {
public static void main(String[] args) throws NoSuchAlgorithmException {
String password = "Test!email30#password";
AES256TextEncryptor encryptor = new AES256TextEncryptor();
encryptor.setPassword("some_salt");
String myEncryptedText = encryptor.encrypt(password);
System.out.println("Encrypted: "+myEncryptedText);
String plainText = encryptor.decrypt(myEncryptedText);
System.out.println("Decrypted: "+plainText);
}
}
Output:
Encrypted:
fureWQHrflMinY+KBOcNeJyYmQv+7Ung/IclGz3iSBYKqTNdgslADg+TMcfFI/unaqZ/P3kDGPco2jZ4vIhrFw==
Decrypted: Test!email30#password
Spring Boot Integration:
You can use #EnableEncryptableProperties in your any configuration class or #SpringBootApplication. See example:
import com.ulisesbocchio.jasyptspringboot.annotation.EnableEncryptableProperties;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.autoconfigure.SpringBootApplication;
import org.springframework.boot.autoconfigure.domain.EntityScan;
import org.springframework.context.annotation.ComponentScan;
import org.springframework.data.jpa.repository.config.EnableJpaRepositories;
import org.springframework.transaction.annotation.EnableTransactionManagement;
#EnableEncryptableProperties
#SpringBootApplication
#ComponentScan(basePackages = {"com.company"})
#EntityScan(basePackages = {"com.company.persistence.entities"})
#EnableJpaRepositories(value = {"com.company.persistence.repository"})
#EnableTransactionManagement
public class Application {
public static void main(String[] args) {
SpringApplication.run(Application.class, args);
}
}
And in any properties/yml file:
email:
password:
# DO-NOT-USE/REMOVE THIS
plain: 'Test!email30#password'
# use this encrypted one
encrypted: ENC(fureWQHrflMinY+KBOcNeJyYmQv+7Ung/IclGz3iSBYKqTNdgslADg+TMcfFI/unaqZ/P3kDGPco2jZ4vIhrFw==)
jasypt:
encryptor:
password: some_salt