Now, we saw, like a little report about password encoded in the last few videos, so let's try to
implement one of the password encoder, which is secret password encoded inside our application and
leverage it to authenticate our Greenshields insider application for that.
First, I have to go to the place where we have configured password encoded with the standard password.
So instead of a standard password encoder, I will be configuring Bakry password.
And so as we discussed, secret password encoder has a constructor which don't need any arguments to
pass.
So with this from chording, I am good.
Like my application is good to use Bakry password and as we discussed, my code should top are my just
method for evaluating the passwords between what we saw in the database and what we are receiving from
the UI.
So that's why I just kept a big point here.
So let's try to start our application in dept.
So meanwhile, let's go and see what users we have in the database.
We have a customer people and in fact that we have an email that we configured previously, which is
under the pretext of blue dot com and his password is five, four, three, two, one.
Now we have our server started.
Let's try to go to the browser and try to access my account.
So it's asking me, correction, I'm giving my username and password is five, four, three, two,
one.
Xining The code will match this method.
So here the password is the one which we're receiving from the UI and encoded password is the one which
we have in the database.
So now let's try to see what is happening inside.
So the password is not enough and the password is also not unknown.
And here I am getting an error saying that whatever you stored inside the database is not to be encoded
password so that my login will fail.
My credentials are right with an error, saying that incorrect password does not look like the reasons
you are telling the spring security.
Go ahead and leverage to decrypt hashing mechanism for violating the conventions.
But you are still saving the password in a plain text inside the database.
So that's why spring security saying I can go ahead and validate because the encoded password, which
is in the database, is not a hash of function.
So due to that we are getting this error.
For that, let's try to go ahead and update our password in a big group hashing mechanism so that Auspine
security also can leverage it and validate the password.
For that, let's go to our database.
But right now we have a problem with our customer table because someone table a password is awful and
fortify only the column is for the family.
But I we need more than that to store a hash value of a password so far that let me drop my this table
drop cable customer so I have to dropped every customer now we have to create a table again.
Customer for that let's go to our script location here.
I have a definition of it.
Let me copy paste it here as well.
And instead of whatever, I'm just keeping it.
That's two hundred for Safer site.
I'm just creating the table post that I can go ahead and insert the same value.
But here John Doe does not have a password inside a database in hashing.
So let's create a new user name, which is a great example, dot com and I want to keep it password
as one file.
And his role also can be one admin.
But I really don't know what is a hash value of one, two, three, four, five in decrypt algorithm.
So that to this one is if you are implementing user details manager where you can create user, the
framework will take care of saving the password in a hash value, since you are declaring that the password
encoded should be password encoded.
But in this scenario, since we don't have that core, what we can do is let's try to go to our website.
This is a site where we can connect the hash value of a simple text.
So for that I'm just giving one, two, three, four is my complete list and runtime keeping attached
to it, because even in decrypted password encoder, the coefficient value that we used to pass in the
second constructor by default, etc. So this could indicate that those many longer dramatic times that
my encoding has to happen.
So as soon as I click cache, I go to.
Hasharon, I'm just copping it now instead of one, two, three, four, five.
I'm just storing into the database the hatch value and I'm inserting it.
So now I will go ahead and log in with Happy.
A great example.
Dot com and password is one, two, three, four, five.
Now I click in this time it dropped again matches.
So here that our password is one, two, three, four, five.
And you can see this is the encoded password that we stored in the database.
So by this time my spring security might have called user by user name and it is having the password
in the form of encode password here.
So now I will check line by line.
So it's not a password encoded password is also known is an ordinal and my password is matching with
the big better now.
So this is a method where it will compare to my plaintext value and the hash to value is same for that.
What it will do is first it will take the hash value and it will call the hash password method with
a password that will result from the UI on the side.
So once that hashing is completed, it will return a boolean value.
Since the hashes of both encoded password and what we calculate it based upon the password is matching,
it will return boolean true, which indicates that we should download the authentication of this user.
So that's why in the UI the time we are getting the application response for my account service.
So this is how we should configure any password encoding.
And you can see it's very easy.
You just have to define what is the password encoded that I have to follow and accordingly should maintain
the values in the database or in Aleppo.
So spring security is taking a lot of pain from developers so that they can focus on business requirement
and it is taking care of all the passwords management here.
But if we have a requirement, when you want to have your own custom password encoder, you are free
to implement the password encoder provided by framework.
And inside that you how to override the methods and code and matches that framework will call your methods
whenever we try to validate the user credentials.
So this is the way how you should configure the password.
Encoders.
Thank you and see you in the next room by.