ApacheCon North America 2017

Clear-text credentials (user passwords) were never a good idea. Not only are both MD5 and SHA1 now dead, even more modern hashing algorithms aren't appropriate for credential storage in an era of hash-lookup sites. Some recent additions to Apache Tomcat have made it easier to use more secure credential-storage mechanisms along with container-managed security. They can even be used to seamlessly upgrade from older, less-secure algorithms to newer, more secure ones. We'll investigate the modifications to Tomcat that allow developers and operations staff to use these features, and look at how to actually plug custom credentials-handling mechanisms into an existing Tomcat-based application.