Jump to: navigation, search


< Jetty‎ | Tutorial
Revision as of 14:33, 23 April 2013 by Jesse.mcconnell.gmail.com (Talk | contribs)

(diff) ← Older revision | Latest revision (diff) | Newer revision → (diff)
Jetty 7 and Jetty 8 are now EOL (End of Life)

All development and stable releases are being performed with Jetty 9.
This wiki is now officially out of date and all content has been moved to the Jetty Documentation Hub

Direct Link to updated documentation: http://www.eclipse.org/jetty/documentation/current/configuring-security-secure-passwords.html

There are many places where you might want to use and store a password, for example for the SSL connectors and user passwords in realms.

Passwords can be stored in clear text, obfuscated, checksummed or encrypted in order of increasing security.

The class org.eclipse.jetty.http.security.Password can be used to generate all varieties of passwords.

Run it without arguments to see usage instructions:

java -cp lib/jetty-http-xxx.jar:lib/jetty-util-xxx.jar org.eclipse.jetty.util.security.Password
Usage - java org.eclipse.jetty.util.security.Password [<user>] <password>

where -xxx.jar signifies the version of jetty that you have installed.

For example, to generate a secured version of the password "blah" for the user "me", do:

java -cp lib/jetty-xxx.jar:lib/jetty-util-xxx.jar  org.eclipse.jetty.util.security.Password me blah

Now you can cut and paste whichever secure version you choose into your configuration file or java code.

For example, the last line below shows you how you would cut and paste the encrypted password generated above into the properties file for a LoginService:

admin: CRYPT:ad1ks..kc.1Ug,server-administrator,content-administrator,admin
other: OBF:1xmk1w261u9r1w1c1xmq
guest: guest,read-only
Don't forget to also copy the OBF:, MD5: or CRYPT: prefix on the generated password. It will not be usable by Jetty without it.