Sample Password Encryption Function Using Database

This is an implementation sample that performs authentication process using account information (user ID, password) stored in the database.

Source code

Delivery package

The sample is provided in the following package.


Provide an implementation sample of the function to perform user authentication (authentication by user ID and password) in web application.

This sample is intended to be used in a business process [1] that executes login process.


The Nablarch implementation project should modify and use this sample implementation to meet the requirements.

[1]This function does not provide the business process that executes the login process. Create a login process according to the requirements in the Nablarch implementation project.

Since this function uses PBKDF2 by default to encrypt passwords, it is necessary to set the number of stretches and salts for password encryption in each project.

For more information on configuration, see Sample Password Encryption Function Using PBKDF2 .


Shows the sample structure.

Class diagram


Responsibilities of each class

Interface definition
Interface Name Summary
PasswordAuthenticator An interface that authenticates users.
PasswordEncryptor An interface that encrypts a password.
Class definition

a) PasswordAuthenticator implementation class

Class name Summary
SystemAccountAuthenticator Class that performs password authentication for the account information stored in the database.

b) PasswordEncryptor implementation class

Class name Summary
PBKDF2PasswordEncryptor Class that performs password encryption using PBKDF2.

c) Utility class

Class name Summary
AuthenticationUtil Utility to get PasswordAuthenticator and PasswordEncryptor from system repository and perform user authentication and password encryption.

d) Entity class

Class name Summary
SystemAccount Class retains user account information and to which Universal DAO search results are mapped.


In the Nablarch implementation project, entity classes are automatically generated using gsp-dba-maven-plugin. This sample includes an entity class automatically generated according to the definition described in Table definition for operation confirmation. When implementing in a project, instead of using the entity class of this sample, modify to use the entity class automatically generated in each project.

e) Exception class

Class name Summary

Exception that occurs when user authentication fails.

Base class of exception related to authentication process. Create an exception class that inherits from this class according to the authentication architecture. This class and its subclasses retain information necessary for the creation of a message to be presented to a user, but do not create a message.


Exception that occurs when authentication fails due to mismatch of account information.

This function memorizes the user ID of the target user.


Exception that occurs when password has expired while authenticating user.

Retains the user ID, password expiration date, and business date used for checking of the target user.


Exception that occurs when user ID is locked during user authentication.

Stores the user ID of the target user and the number of authentication failures that lock the user ID.

Table definition

The definition of the account table used in this sample is shown below. When importing this sample into the implementation project, modify the SQL file and source code according to the table definition of the implementation project.


The system account table stores the account information.

Logical name Physical name Java type Limitations
User ID USER_ID java.lang.Integer Primary key
Login ID LOGIN_ID java.lang.String  
Password PASSWORD java.lang.String  
User ID lock USER_ID_LOCKED boolean true when locked
Password expiration date PASSWORD_EXPIRATION_DATE java.util.Date  
Authentication failed count FAILED_COUNT java.lang.Short  
Effective date (From) EFFECTIVE_DATE_FROM java.util.Date  
Effective date (To) EFFECTIVE_DATE_TO java.util.Date  
Last login date and time LAST_LOGIN_DATE_TIME java.util.Date  


Only the attributes required for this sample are listed in the above table definition. In the Nablarch implementation project, the table design should be done to meet the requirements by adding necessary user attributes to this table and creating user information tables, etc. that are tied to this table on a one-to-one basis.

How to Use

This section describes how to use password authentication using the account information stored in the database.

The features of password authentication are shown below.

  • Check the effective date (From/To) of account information during authentication.
  • Check the expiration date of the password during authentication.
  • Lock the user ID when the specified number of authentications fail consecutively. If the authentication succeeds before the specified number of times is reached, the number of failures is reset.
  • Authenticate using an encrypted password. This feature provides password encryption using PBKDF2 by default.
  • Record the date and time of the last login. The system date and time is used to update the last login date and time only if the authentication is successful.

In addition, PasswordAuthenticator and PasswordEncryptor are supposed to be obtained from Nablarch system repository and used. Because components from the system repository should not be retrieved and used at each point in the business function, this function provides AuthenticationUtil, which wraps the retrieval of components from the system repository and the password authentication and password encryption processes.

AuthenticationUtil should be used for the login and user registration functions implemented in the project.

How to Use SystemAccountAuthenticator

This section describes how to use the SystemAccountAuthenticator.

<component name="authenticator" class="">
  <!-- PasswordEncryptor to encrypt passwords -->
  <property name="passwordEncryptor" ref="passwordEncryptor" />

  <!-- Class that provides transaction control to database -->
  <property name="dbManager">
    <component class="nablarch.core.db.transaction.SimpleDbTransactionManager">
      <property name="dbTransactionName" value="authenticator"/>
      <property name="connectionFactory" ref="connectionFactory"/>
      <property name="transactionFactory" ref="transactionFactory"/>

  <!-- Number of authentication failures to lock user IDs -->
  <property name="failedCountToLock" value="5"/>

A description of the property is given below.

property name Settings
passwordEncryptor (required)

A PasswordEncryptor used to encrypt the password.

Specify the component name, which was configured by referring to Sample Password Encryption Function Using PBKDF2 , to ref.

dbManager (required)

SimpleDbTransactionManager, which provides transaction control to the database.

Specify an instance of nablarch.core.db.transaction.SimpleDbTransactionManager class.


SystemAccountAuthenticator transaction control shall be configured to use a separate transaction from the individual application so that the transaction control of the PasswordAuthenticator does not affect the processing of the individual application. In the configuration example, since the name “authenticator” is specified for dbTransactionName, configure the transaction settings such that the same name is not used in individual applications.


Number of authentication failures to lock the user ID.

If this is not specified, it is set to 0 and the user ID lock function is not used.

How to Use AuthenticaionUtil

This section describes how to use AuthenticaionUtil.

AuthenticationUtil implements the following utility methods. Since the component name to acquire a component from the system repository needs to be combined with the component name registered in How to Use SystemAccountAuthenticator , modify the source code if the component name is different from the above configuration example.

encryptPassword Obtain PasswordEncryptor from the system repository with the component name passwordEncryptor and call PasswordEncryptor#encrypt(String, String).
authenticate Obtain the PasswordAuthenticator from the system repository with the component name authenticator and call PasswordAuthenticator#authenticate(String, String).

Usage example of AuthenticaionUtil

The following is an example of the implementation of the authentication process using this sample.

In the implementation project, implement the authentication process that meets the requirements by referring to this implementation example.

// Obtain the user ID and password to authenticate in advance.
// String userId = ・・・;
// Strign password = ・・・;

try {

    AuthenticationUtil.authenticate(userId, password);

} catch (AuthenticationFailedException e) {

    // Process when authentication fails

} catch (UserIdLockedException e) {

    // Process when a user ID is locked

} catch (PasswordExpiredException e) {

    // Process when password has expired



In the above example, the processing is divided finely according to the status of the authentication error. However, if it is not necessary to divide the processing finely, the processing may be performed by supplementing the upper exception class as follows.
try {

    AuthenticationUtil.authenticate(userId, password);

} catch (AuthenticationException e) {
    // Exception handling