Wildfly Jboss Howto Secure Customer Passwords

If you are familiar with Wildfly/JBoss you might now that you can easily configure your system to use JAAS database authentication for the login process of your customer. Because it is considered bad practice to store passwords in clear text a hash-algorithm (e.g. SHA256, MD5) can be specified to encrypt them. Further informations can be found under here.

The problem with that approach is that your passwords will be vulnerable to dictionary and rainbowtable attacks (refresh your knowlegde here).
One way to face this problem is to use salted hashed passwords but the standard DatabaseServerLoginModule does not support that. But you can use this extension of the DatabaseServerLoginModule.
The configuration is fairly easy:

Wildfly/JBoss Konfiguration

1. Create module
Create the new module de.rtner.security.main and configure the module.xml like this
 1 <?xml version="1.0" encoding="UTF-8"?>
 2 <module xmlns="urn:jboss:module:1.1" name="de.rtner.security">
 3     <resources>
 4         <resource-root path="PBKDF2-1.0.4.jar"/>
 5         <resource-root path="SaltedDatabaseLoginModule-1.0.4.jar"/>
 6     </resources>
 7    <dependencies>
 8         <module name="javax.api"/>
 9         <module name="javax.servlet.api"/>
10         <module name="org.jboss.as.web-common"/>
11         <module name="org.jboss.logging"/>
12         <module name="org.picketbox"/>
13         <module name="sun.jdk"/>
14     </dependencies>
15 </module>
Both declared jars must also be present in that folder.

2. Update module.xml of picketbox.
Every custom login module has to be declared as a dependencies in the module.xml of picketbox. So just add this line:
3. Update standalone.xml
1 <login-module code="de.rtner.security.auth.spi.SaltedDatabaseServerLoginModule" flag="required" module="de.rtner.security">
2  <module-option name="dsJndiName" value="java:jboss/datasources/ExampleDS"/>
3  <module-option name="principalsQuery" value="select password from User where login=?"/>
4  <module-option name="rolesQuery" value="select role, 'Roles' from UserRole where login=?"/>
5  <module-option name="hmacAlgorithm" value="HMacSHA256"/>
6  <module-option name="formatter" value="de.rtner.security.auth.spi.PBKDF2HexFormatter"/>
7  <module-option name="engine" value="de.rtner.security.auth.spi.PBKDF2Engine"/>
8  <module-option name="engine-parameters" value="de.rtner.security.auth.spi.PBKDF2Parameters"/>
9 </login-module>

The password encryption can be done with the following function. 

 1 private String createPbKdF2Passwort(String password) throws NoSuchAlgorithmException
 2 {
 3  PBKDF2Formatter formatter = new PBKDF2HexFormatter();
 4  SecureRandom sr = SecureRandom.getInstance("SHA1PRNG");
 5  byte[] salt = new byte[8];
 6  sr.nextBytes(salt);
 7  int iterations = 1000;
 8  PBKDF2Parameters p = new PBKDF2Parameters("HmacSHA256", "ISO-8859-1", salt, iterations);
 9  PBKDF2Engine e = new PBKDF2Engine(p);
10  p.setDerivedKey(e.deriveKey(password));
11  return formatter.toString(p);
12 }