Password encryption

Crowd can encrypt your password using one of the following algorithms:

• AES/CBC/PKCS5Padding (default)

• DES/CBC/PKCS5Padding

• DESede/CBC/PKCS5Padding

To change the default encryption algorithm:

1. Issue the admin authenticated PUT request to the following URL:
   
   {baseUrl}/rest/admin/1.0/encryption/encryptor.
2. Set content type to application/json.
3. Set body to algorithm name.

List of available names can be found through GET request to {baseUrl}/rest/admin/1.0/encryption

Yes. Password encryption is enabled by default in Crowd 4.2. To disable it, issue the admin authenticated PUT request to the following URL {baseUrl}/rest/admin/1.0/encryption/disable

To reenable your password encryption, follow the procedure for changing the encryption algorithm.

Issue admin authenticated PUT request to the following url {baseUrl}/rest/admin/1.0/encryption/changeKey .

Existing data will be automatically re-encrypted using new encryption key.

Rest endpoints support both basic authentication and Crowd token key (usually crowd.token_key). Depending on configuration, Crowd might not allow to re-use token key cookie on IP address different than the initial one.

If the encryption key is missing, Crowd won’t be able to decrypt passwords. All passwords will have to be restored manually.

If your admin account comes from remote directory, admin won’t be able to authenticate. In such case Crowd will need to be started in recovery mode to restore passwords manually. See Using recovery mode.

To disable password encryption during upgrade:

Start Crowd with the following flag -Dcrowd.encryption.upgrade.disabled=true

For higher security, please restrict filesystem permission  for {crowdHome}/shared/keys so that only Crowd user (on all nodes) have access to this directory.