JDBCRealm with digested passwords.

Question

Hi,
I've sucessfully set up a JDBCRealm to accept users and there log in details but the passwords are currently cleartext. I need to encrypt them with MD5.
I've followed the instructions here:
http://tomcat.apache.org/tomcat-3.3-doc/JDBCRealm-howto.html
so I've added digest="MD5" to the Realm element in my server.xml file. The way i am trying to enter the user name and encrypted password details into the DB is as follows.
stmt.executeUpdate(
                    "insert into users values('" + this.getUserName() +
                    "\', md5('" + this.getUserPassword() + "'));" );
But I see in the instructions something about a static encryption method:
final public static String digest(String password,String algorithm). in org.apache.tomcat.modules.aaa.RealmBase
It says "the jar where RealmBase class can be found is %TOMCAT_HOME%/lib/container/tomcat_modules.jar" I do not have this jar in my tomcat installation. I am using tomcat 5.0.28. Can anyone give me any tips or links to help me get this working.
Cheers,
Joe.

Answer 1

Hi Ive made some progress on this. It seems the MD5 encryption mysql uses differs slightly from the MD5 encryption tomcat uses. So I am trying to use MD5 encryption in tomcat to encrypt the password before inserting it into the DB. Heres the code I'm trying to use Note for now i have hardcoded the username to be root and the password to be password:
     public String getDigestedPassword()
          try {
               // Obtain a new message digest with "digest" encryption
               MessageDigest md = (MessageDigest) MessageDigest.getInstance("MD5").clone();
               // encode the credentials
               md.update("password".getBytes());
               // Digest the credentials and return as hexadecimal
               return (HexUtils.convert(md.digest()));
          } catch(Exception e) {
               sm_log.error( "Error creating user", e );
     }Then in another method I have this:
               ResultSet result = stmt.executeQuery(
                         "select * from users where user_name='root' and user_pass ='" +
                         this.getDigestedPassword() + "'" );
               if(!result.first()){
                    result.moveToInsertRow();
                    result.updateString( 2, "root" );
                    result.updateString( 3, this.getDigestedPassword() );
                    result.insertRow();
               }However I am having trouble finding the class HexUtils. I am getting this error:
java.lang.NoClassDefFoundError: org/apache/tomcat/util/buf/HexUtils
Am i missing something from my class path Is there a jar file I need. Any help appreciated.
Cheers,
Joe.