Question

i m using HTTP Digest to connect to my Spring application, using the Spring DigestAuthenticationFilter.
The application is using Tomcat 7.
It works fine with plaintext password (in the database)

My problem is : i want to store the hashed passwords (with a salt if possible), and not in plaintext. But if i understood well, HTTP Digest requires the password to be in plaintext.

Is there a way to change this in Spring Security ?

Answer 1

i want to store the hashed passwords
(with a salt if possible), and not in
plaintext. But if i understood well,
HTTP Digest requires the password to
be in plaintext.

Is there a way to change this in
Spring Security ?

No, this is not changeable, atleast at the time of writing this. The Spring Security documentation on Digest Authentication states the following, where is it quite evident that the passwords have to be in clear text.

The configured UserDetailsService is
needed because DigestProcessingFilter
must have direct access to the clear
text password of a user. Digest
Authentication will NOT work if you
are using encoded passwords in your
DAO.