CODEWITHSUNDEEP
md5jakarta-maildigest-authenticationsmtp-auth
Martin
Martin

Reputation: 1807

How to use DIGEST-MD5 with Javamail

My application sends emails using Javamail. In order to authenticate with the email server I currently have to store the password somewhere in the application configuration files. I'd like to avoid this, providing at least a bit of security by storing only a hash of the password.

According to the wikipedia article http://en.wikipedia.org/wiki/Digest_access_authentication I should be able to achieve this by using DIGEST-MD5 authentication, which allows the application to authenticate using only an MD5 hash of the username:realm:password instead of needing to know the cleartext password.

I can't find any clear example on how to use DIGEST-MD5 in Javamail. I see some references to a class com.sun.mail.smtp.DigestMD5 but this doesn't exist in the latest javamail package and I can't find any explanation why.

The code below is as far as I could get with it. The email is sent successfully but the debug output seems to indicate it is still using PLAIN authentication through SASL, even though I've specified that DIGEST-MD5 is the only mechanism allowed.

Beyond that, I'm still specifying the plaintext password as an argument to the transport.connect method, whereas I want to be providing the hashed username:realm:password instead.

Can anyone point me to a working example of using DIGEST-MD5 with Javamail? Thanks!

Code below, with try/catch blocks removed...

Properties properties=new Properties();
properties.put("mail.smtp.starttls.enable","true");
properties.put("mail.smtp.timeout",3000); // 3 second timeout establishing connection
properties.put("mail.smtp.auth.mechanisms","DIGEST-MD5");
Session session=Session.getInstance(properties);
session.setDebug(true);
Message message=new MimeMessage(session);
message.setFrom(constructAddress(myGmailAddress,"my name"));
message.addRecipient(Message.RecipientType.TO,constructAddress(recipientEmailAddress,"Recipient Name"));
message.setSubject("test email");
message.setText("...");
SMTPTransport transport=(SMTPTransport)session.getTransport("smtp");
transport.setSASLEnabled(true);
transport.setSASLRealm("gmail.com");
transport.connect("smtp.gmail.com",587,myGmailAddress,password);
transport.sendMessage(message,message.getAllRecipients());
transport.close();

Here's the (truncated) debug output:

DEBUG: setDebug: JavaMail version 1.5.1
DEBUG: getProvider() returning javax.mail.Provider[TRANSPORT,smtp,com.sun.mail.smtp.SMTPTransport,Oracle]
DEBUG SMTP: useEhlo true, useAuth false
DEBUG SMTP: trying to connect to host "smtp.gmail.com", port 587, isSSL false
220 mx.google.com ESMTP pb7sm87689296pac.10 - gsmtp
DEBUG SMTP: connected to host "smtp.gmail.com", port: 587

EHLO laptop-mj
250-mx.google.com at your service, [(my ip address)]
250-SIZE 35882577
250-8BITMIME
250-STARTTLS
250-ENHANCEDSTATUSCODES
250 CHUNKING
DEBUG SMTP: Found extension "SIZE", arg "35882577"
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "STARTTLS", arg ""
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
STARTTLS
220 2.0.0 Ready to start TLS
EHLO laptop-mj
250-mx.google.com at your service, [(my ip address)]
250-SIZE 35882577
250-8BITMIME
250-AUTH LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN
250-ENHANCEDSTATUSCODES
250 CHUNKING
DEBUG SMTP: Found extension "SIZE", arg "35882577"
DEBUG SMTP: Found extension "8BITMIME", arg ""
DEBUG SMTP: Found extension "AUTH", arg "LOGIN PLAIN XOAUTH XOAUTH2 PLAIN-CLIENTTOKEN"
DEBUG SMTP: Found extension "ENHANCEDSTATUSCODES", arg ""
DEBUG SMTP: Found extension "CHUNKING", arg ""
DEBUG SMTP: Authenticate with SASL
DEBUG SMTP: SASL AUTH command trace suppressed
DEBUG SMTP: SASL Mechanisms:
DEBUG SMTP:  LOGIN
DEBUG SMTP:  PLAIN
DEBUG SMTP:  XOAUTH
DEBUG SMTP:  XOAUTH2
DEBUG SMTP:  PLAIN-CLIENTTOKEN
DEBUG SMTP: 
DEBUG SMTP: SASL callback length: 2
DEBUG SMTP: SASL callback 0: javax.security.auth.callback.NameCallback@55f6efd2
DEBUG SMTP: SASL callback 1: javax.security.auth.callback.PasswordCallback@46faf015
DEBUG SMTP: SASL client PLAIN
DEBUG SMTP: use8bit false
MAIL FROM:<(my gmail address)>
250 2.1.0 OK pb7sm87689296pac.10 - gsmtp
... continues on with successful email transmission

Upvotes: 1

Views: 2268

Answers (1)

Bill Shannon
Bill Shannon

Reputation: 29971

DIGEST-MD5 allows the server to not store the password, but the client still needs the password. The main advantage is that the password is never sent in clear text to the server.

If the server supported DIGEST-MD5 (Gmail doesn't appear to), you use it just like any other authentication, supplying the password to the connect method.

Upvotes: 1

Related Questions