Question

I’m using Apache DS with Spring LDAP for authentication and user management. Apache DS sends password fields as hashed byte arrays, so I need to decrypt it into String. I’m using MD5 hashing.

For example, here’s the window that is used to enter password using Apache DS Studio:

(For the sake of demonstration, I’d like to tell the entered password which is 1)

Apache DS sends password fields as hashed byte arrays. When I try to get it using Spring LDAP like below, I got [B@66ca6254. I need to decrypt it and got the hex value of it which is c4ca4238a0b923820dcc509a6f75849b as it is shown above.

Answer 1

You’ve got two problems here:

• You’re using the term “decrypt” as if you were actually able to recover the original password. That’s not the case. Hopefully you understand this already, and you’re just using the term “decrypt” inappropriately
• You’re calling toString() on a byte array. That’s what’s giving the value “[B@66ca6254” which is an indication that the object you’re calling it on is a byte array, then a hash. What you’re actually interested in is a hex representation of the byte array.

Basically you just need to convert the byte array to a hex string. There are various ways of doing that – either in your own code, or using a third party library such as Apache Commons Code and its Hex class. If you don’t want to include an extra library, there are loads of code snippets for byte array to hex string conversion on Stack Overflow, such as here. (There’s also javax.xml.bind.DataTypeConverter, but I personally wouldn’t want to use that for general conversion – it smells too much like an XML-specific type to me. I dare say it would work fine, it just gives the wrong impression in code.)

EDIT: Now that you’ve told us the bytes that you’re getting, you don’t just want to use hex. You’ve been given the ASCII encoded form of "{MD5}xMpCOKC5I4INzFCab3WEmw==", which itself shows that it’s MD5 and then has the base64-encoded version. You should therefore:

• Convert the byte array to a string using new String(data, "ASCII")
• Check that the string starts with "{MD5}"
• Decode the rest of the string as base64 (i.e. strip the first 5 characters, then run the rest through base64 decoding). Again, you can use Apache Commons Codec for this, or this public domain base64 decoder (or many other solutions).
• At that point, you’ve got the real raw binary data of the hash. You can then convert that to hex if you want, as discussed earlier.