CODEWITHSUNDEEP
javajakarta-eecdi
Wesley Jackson
Wesley Jackson

Reputation: 36

Injected PasswordHash always throws null pointer when initializing with parameters

When initializing an injected PasswordHash instance with parameters, a null pointer exception is always thrown.

Using several different examples online, I always get the same result. Here is the most recent example I followed: https://medium.com/@swhp/explore-hash-feature-on-java-ee-security-jsr-375-soteria-7fe3b1953785 . The IDE says the injected Pbkd2PasswordHash has an "Unsatisfied Dependency: no bean matches the injection point". This makes sense, as it is an interface and I am not creating a new class with that interface. However, all of the examples I've seen online inject this class without implementing it.

I am able to avoid the null pointer if I implement the PasswordHash or PBkdf2PasswordHash interface and override the methods, but this defeats the purpose of passing in the parameters with the specific iterations, algorithim, salt size, and/or key size values.

@Inject
Pbkdf2PasswordHash pbkdfHash;

@PostConstruct
public void init() {
    Map<String, String> parameters = new HashMap<>();

    parameters.put("Pbkdf2PasswordHash.Iterations", "3072");
    parameters.put("Pbkdf2PasswordHash.Algorithm", "PBKDF2WithHmacSHA512");
    parameters.put("Pbkdf2PasswordHash.KeySizeBytes", "64");
    parameters.put("Pbkdf2PasswordHash.SaltSizeBytes", "64");

    this.pbkdfHash.initialize(parameters);
}

I expect that when I initialize the injected PasswordHash with parameters, the instance will automatically hash the text passed in. Because it seems I am not injecting any bean and I'm just injecting an interface, it only returns a null pointer when the instance is initialized.

Upvotes: 0

Views: 442

Answers (1)

Wesley Jackson
Wesley Jackson

Reputation: 36

One implementation is provided by Glassfish and Wildfly as Pbkdf2PasswordHashImpl. I needed to add wildfly-ee-security or org.glassfish.soteria:javax.security.enterprise to pull in this class. I suspect the examples I was looking at were implementing the PasswordHash interface themselves without showing the bean.

Thanks to Siliarus for providing the link to Soteria implementation: https://github.com/javaee/security-soteria/blob/master/impl/src/main/java/org/glassfish/soteria/identitystores/hash/Pbkdf2PasswordHashImpl.java

I am now running into build errors regarding the dependencies needed, but that is outside of the scope of this question. If you are interested, there is already an open issue at: https://github.com/eclipse-ee4j/soteria/issues/193

Upvotes: 0

Related Questions