[MAGNOLIA-8761] Superuser password corrupt after Magnolia update (Invalid salt version) Created: 13/Feb/23  Updated: 09/Mar/23

Status: Open
Project: Magnolia
Component/s: None
Affects Version/s: 6.2.27
Fix Version/s: None

Type: Bug Priority: Neutral
Reporter: Pierre Sandrin Assignee: Unassigned
Resolution: Unresolved Votes: 0
Labels: security
Remaining Estimate: Not Specified
Time Spent: Not Specified
Original Estimate: Not Specified
Environment:

Magnolia 6.2.28
Postgres DB


Attachments: PNG File Bildschirm­foto 2023-02-13 um 16.07.41.png    
Issue Links:
causality
relation
Template:
Acceptance criteria:
Empty
Task DoD:
[ ]* Doc/release notes changes? Comment present?
[ ]* Downstream builds green?
[ ]* Solution information and context easily available?
[ ]* Tests
[ ]* FixVersion filled and not yet released
[ ]  Architecture Decision Record (ADR)
[ ]* migration task for base64 passwords
Bug DoR:
[ ]* Steps to reproduce, expected, and actual results filled
[ ]* Affected version filled
Date of First Response:
Epic Link: Security maintenance
Team: AdminX

 Description   

Steps to reproduce

  1. Update a Magnolia Project from 6.2.24 to 6.2.28
  2. Try to loging with superuser

Expected results

The superuser account should work like before.

Actual results

There is an Exception (see attached screenshot)
javax.security.auth.login.LoginException: java.lang.IllegalArgumentException: Invalid salt version.

Workaround

Login with another user (If you have one) and reset the superuser password. If you don't have one, you can bootstrap the superuser on module update with the Version Handler.

Development notes

It did happen so all Projects we updated that run on Mironet Servers (shared hostings & Kubernetes). All use a postgres Database. It did not happen on our local instances thet use h2 Database.

I think the breaking change is in version 6.2.27 but did not find anything in the release notes that could cause this issue.

 



 Comments   
Comment by Pierre Sandrin [ 14/Feb/23 ]

The password was bootstrapped as base64 (Instead of a BCrypt hash) which seems to work until 6.2.27. You can check the pswd property of the user in the JCR browser. A bcrypt hash must start with $2....

If you reset the password in the security app the password will be hashed correctly.

Generated at Mon Feb 12 04:35:34 CET 2024 using Jira 9.4.2#940002-sha1:46d1a51de284217efdcb32434eab47a99af2938b.