Question

I am trying to use hashing for a test case in tomcat-users.xml. (I plan on implementing a subclass of one of the Realm classes to do the real authentication with auditing, logging, etc.) I ran the command

$TOMCAT_HOME/bin/digest.sh -a sha secret

and got the result ‘secret:e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4’. I pasted this into the

<user password="e5e9fa1ba31ecd1ae84f75caaa474f3a663f05f4" roles="test" username="tester"/>

line. I added the appropriate magic words to my web.xml to use DIGEST authentication for the servlet (role = test), but when I try logging in, I get a 401 error.

I “watched” the transactions with wireshark, and it seems the browser is sending all of the right responses.

Am I doing this right? It seems to me that the digest authentication will send back MD5(“username:realm:password”), so there is no way for tomcat to compare the value stored in the tomcat-users.xml file with the value sent by the browser, since it would require either “unhashing” the password value from tomcat-users.xml or “username:realm:password”.

Should I be storing the hash of “username:realm:password” instead?

Answer 1

Boy, that was a DUE (dumb user error)!

I should have read the tomcat docs more carefully:

If using digested passwords with DIGEST authentication, the cleartext used to generate the digest is different. In the examples above {cleartext-password} must be replaced with {username}:{realm}:{cleartext-password}. For example, in a development environment this might take the form testUser:localhost:8080:testPassword.

Exactly the last part of my own question :-).