Improve login security

[jamoore]

Also:

• Review hash/salt functions
• Add method changeUserPasswordWithHash (for 5.0)
• Accept pre-hashed passwords
• Expand hash column to at least 100 characters (or bit vectors up to a min. of 512)
• Add "hashType" column.
• Turn on SSL w/ ADH as a "preferred" transport by default (#838)
  • See ​http://stackoverflow.com/questions/9665032/spring-security-ldap-and-md5-hashed-passwords
• ​http://arstechnica.com/security/2013/09/long-passwords-are-good-but-too-much-length-can-be-bad-for-security/ (django/4096 limit)

[jmoore]

This along with OmeroSessions rework is important, but doesn't fit into 4.1

[agilo]

Updated status, related task in progress

[jamoore]

Discussing hash requirements with Chris. This may need to have effort on the 4.4.x line.

[jamoore]

​https://github.com/openmicroscopy/openmicroscopy/pull/1800 opened. Until the database specification is modified to allow more data to be stored in the 'hash' column, something like ​http://code.google.com/p/jbcrypt/ is not possible. While we wait on that, this simple salting may be worth it.

[jmoore <josh@…>]

(In [54ef5d5267396466a4ac9a5c4e8bf5ee73c517c1/ome.git] on branch develop) Simple salting of MD5 passwords (See #1387)

While waiting on a more complete hashing system,
adding a simple salt to the 'hash' column reduces
the benefit to any attacker who may gain access to
the postgresql data.

Passwords are updated as they are changed.

[Josh Moore <josh@…>]

(In [978b5c7d049bd344647a8e7abf9699b85f74a5be/ome.git] on branch develop) Merge pull request #1800 from joshmoore/1387-simple-salt

Simple salting of MD5 passwords (See #1387)

[jmoore <josh@…>]

(In [af3857065f174edf43cddfea3450add583deb096/ome.git] on branch dev_4_4) Simple salting of MD5 passwords (See #1387)

While waiting on a more complete hashing system,
adding a simple salt to the 'hash' column reduces
the benefit to any attacker who may gain access to
the postgresql data.

Passwords are updated as they are changed.