Credential Managers

Credential managers are used to communicate with data-sources, in order to validate and manage credentials. A Credential Manager is in charge of checking a password by pre-hashing it with a certain algorithm as needed or to leave it unchanged, so the back-end repository can do that work. In addition, Credential Managers perform other operations on credentials only. A Credential Manager can be used in several places in the configuration, (i.e. in authenticators, SDK plugins, script procedures), to verify or transform credentials; it is also used internally by OAuth flows that accept a credential directly (e.g., the Client Credentials flow and the Resource Owner Password Credentials flow).

The Curity Identity Server supports several algorithms for password transformation:

  • plaintext The plaintext algorithm doesn’t transform the password. Using this algorithm, means that the passwords will be sent in plaintext to the backend data-source, so usage of this algorithm is highly discouraged if the back-end will not do the appropriate hashing.
  • BCrypt When using this algorithm, passwords hashes are stored with the $2a$ prefix. The configuration allows to modify the expansion rounds used when hashing a password.
  • phpass When using this algorithm, passwords hashes are stored with the $P$ prefix. Hashes of the prefix $H$ can also be verified. The configuration allows to modify the number of iterations the Phpass algorithm does for password hashing.
  • Sha2WithSha256 When using this algorithm, passwords hashes are stored with the $5$ prefix. The configuration allows to set the number of times Sha256 encryption will be applied and the usage of a predefined salt (which is not recommended as it makes attacks on hashes easier if the data is compromised).
  • Sha2WithSha512 When using this algorithm, passwords hashes are stored with the $6$ prefix. The configuration allows to set the number of times Sha512 encryption will be applied and the usage of a predefined salt (which is not recommended as it makes attacks on hashes easier if the data is compromised).

Note

Keep in mind that the setting related to the cost of each algorithm is used only when creating/updating a password. Password verification doesn’t use this setting, it will work even when having a different cost configured than the one the saved password was created with, since the saved password’s hash is used to figure out how to verify it (using the cost and salt of the saved hash).