What is the difference between the clear-text and digest form of the ValidatePassword() method which can be used in the OERealm server class when using Single Point of Authentication (SPA) with the REST Adapter ?

When to use the clear-text form of the ValidatePassword() method of the OERealm server class when using SPA with the REST Adapter ?

When to use the digest form of the ValidatePassword() method of the OERealm server class when using SPA with the REST Adapter ?

The OERealm HybridRealm interface allows the following forms in the ValidatePassword() method:

1. The clear-text form of the ValidatePassword() method
 

/*------------------------------------------------------------------------------
     Purpose: validate a password for a given user using clear-text
     Notes: 
     INPUT : theUserId - positive user number
                       - For example the _User._User_number.
             password  - String value to be set as the password
    ------------------------------------------------------------------------------*/
    METHOD PUBLIC LOGICAL ValidatePassword
          ( INPUT theUserId AS INTEGER, 
            INPUT password AS CHARACTER ):

2.  The digest form of the ValidatePassword() method

/*------------------------------------------------------------------------------
     Purpose: validate a password for a given user using digest
     Notes: 
     INPUT : theUserId - positive user number, for example the _User._User_number.
             digest    - String representing the digest value of the password
             nounce    - String representing the nounce
             timestamp - String representing the timestamp.
    ------------------------------------------------------------------------------*/
    METHOD PUBLIC LOGICAL ValidatePassword
               ( INPUT theUserId AS INTEGER, 
                 INPUT digest AS CHARACTER, 
                 INPUT nonce AS CHARACTER, 
                 INPUT timestamp AS CHARACTER ):

The OERealmUserDetails bean in the appSecurity-xxxx-oerealm.xml template contains the "realmPwdAlg" property.

When realmPwdAlg is set to "0", then the REST application (via the Spring Security Framework) will send the user's password (e.g. from the login page) to the AppServer in clear-text.

Use this form only if the OERealm server class has clear-text access to the user account's stored password value or is using a 3rd party library's validation function that takes a HTTP Digest password as an input parameter. 

To guard against someone sniffing out the password over the wire it is recommended that you use SSL between the REST web application and the AppServer which will encrypt everything that goes over the wire, unless the REST web application and AppServer are hosted on the same server. 

When the "realmPwdAlg" property is set to "3", then HTTP Digest is used. In simple terms:

1. The user's password is first hashed with SHA1 and then Base64-encoded before it is sent to the AppServer.
2. The OERealm server class will repeat the same steps and compare the two hashes to see if they match up.

Use this form when the OERealm server class is required to encode the client's password before it can be compared with the value stored in the user account [record], or the server class calls a 3rd party library's validate function that requires a clear-text password value as an input parameter. 

This means that it is not possible to use passwords stored in the _User._Password field, because the password in this field is encoded with Progress' own proprietary algorithm via the ENCODE function. This form is secure for use in all OERealm client and OERealm server class connections without requiring SSL/TLS (secure because the value cannot be recovered into a clear-text value). For further detail refer to Article:

•  What are the basic steps to authenticate REST clients against the OpenEdge database _User table ?