Package org.acemq.rabbitmq.admin

Class PasswordHash

java.lang.Object
org.acemq.rabbitmq.admin.PasswordHash
public final class PasswordHash extends Object
A password hashed the way RabbitMQ's internal user database stores it. 

 admin.createUser("orders-service", PasswordHash.sha256(secret), "monitoring");

The format is base64(salt + digest(salt + utf8(password))) with a random four-byte salt — what rabbit_password_hashing_sha256 and rabbit_password_hashing_sha512 compute, and what password_hash in a user or in a definitions file holds. Computed here, the password never leaves this process: the broker is sent the hash and the name of the algorithm and can verify a login against it, but cannot recover the password from it.

The management API also has GET /api/auth/hash_password/{password}, which this class deliberately does not call. It puts the password in a URL path, which is the one part of a request that access logs, proxies and browser histories all record.

toString() does not print the hash. A hash is not the password, and it is still enough to stand up a broker the password works against.

  • Field Details

  • Method Details

    • sha256

      public static PasswordHash sha256(String password)
      Parameters:
      password - the password to hash, which is not kept
      Returns:
      its salted SHA-256 hash, with a fresh salt

    • sha512

      public static PasswordHash sha512(String password)
      Parameters:
      password - the password to hash, which is not kept
      Returns:
      its salted SHA-512 hash, with a fresh salt

    • of

      public static PasswordHash of(String hash, String algorithm)
      A hash computed elsewhere — read from a secrets store, or out of a definitions export.
      Parameters:
      hash - the base64 password_hash
      algorithm - SHA256 or SHA512
      Returns:
      it, checked to be base64 that is longer than a salt

    • matches

      public boolean matches(String password)
      Parameters:
      password - a candidate
      Returns:
      whether the broker would accept it for this hash

    • hash

      public String hash()
      Returns:
      the base64 value sent as password_hash

    • algorithm

      public String algorithm()
      Returns:
      the value sent as hashing_algorithm

    • equals

      public boolean equals(Object other)
      Overrides:
      equals in class Object

    • hashCode

      public int hashCode()
      Overrides:
      hashCode in class Object

    • toString

      public String toString()
      Overrides:
      toString in class Object