Salted hash

Question

Hi,
I'm using an SQLAuthenticationProvider with SALTEDHASH as for the password style, and SHA-1 as the password algorithm. I'm able to create users and generate passwords. However, I must use an external website to manage user creations. That means I must be sure that the hashed passwords created by the website be equal to those one weblogic would interpret. I managed to obtain the correct generation when salted hash is not used. In this last case I didn't. Somewhere I read that the salt can be read from SerializedSystemIni.dat. I tried but without any results. I also tried to use method weblogic.security.internal.SerializedSystemIni.getSalt. I'm using the following code:
     public static void main(String[] args){
          try {
               MessageDigest sha = MessageDigest.getInstance("SHA1");
               sha.reset();                    
               sha.update(weblogic.security.internal.SerializedSystemIni.getSalt("D:\\WebLogic\\user_projects\\domains\\plsdomain\\security\\SerializedSystemIni.dat"));
               byte[] hash = sha.digest(data.getBytes());               
               System.out.print(Base64.encodeBase64String(hash));               
          } catch (NoSuchAlgorithmException e) {
               e.printStackTrace();
Apparently, the password being generated using the salted hash is more than the 160bit expected for SHA-1. I thought the salt is being added to it, but how. It is obvious that it wouldn't make sense to simply add the salt in every password since it is fixed and stored in an external file.
Any help would be very much appreciated.
Thankyou,
- Fra.
Edited by: user8995156 on 7-set-2010 2.20

Answer 1

You need to know the salt value to create the same hash value that Weblogic Creates.
The value of the salt cannot be disclosed due to security reasons.
You will have to look for some other alternative.
-Faisal