Xml file for login authentication

Question

Can xml file be used for login purpose ? I want to store the login id and password in xml and retrieve it from a java program to check if the one user entered matches with any of the data in the xml. inshort I want to use xml for authenticating a user.

r u using any framework like spring, struts.....for this? – Java Apr 02 '12 at 06:31 — Java, Apr 02 '12 at 06:31
No I am using simple java swing – Poonam Hoshi Apr 02 '12 at 06:32 — Poonam Hoshi, Apr 02 '12 at 06:32

score 1 · Answer 1 · edited May 23 '17 at 10:08

In order to make your XML application to safely save passwords, you will need an encryption mechanism. Bouncy Castle.org provide an open and free lightweight cryptography API for Java.

This way you can store an encrypted String for the password in your XML file. Use SAX and you are ready to develop.

The principle is pretty much similar to the /etc/passwd mechanism used traditionally in Unix systems for many years. You just use XML, instead of a text file.

Your XML file will look like that:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<!DOCTYPE users SYSTEM "users.dtd">
<users>
    <user>
        <lastname>John</lastname>
        <firstname>Doe</firstname>
        <code>admin</code>
        <password>DREbKLT4rX3e4j+kh3AXNM0bkjw=</password>
        <role>Administrator</role>
    </user>
...

You could find a Java example here, that shows how to use SAX with Java.

score 0 · Answer 2 · answered Apr 02 '12 at 06:33

0

Can you store credentials in a text file? Of course. Is it a good idea? Most likely not.

answered Apr 02 '12 at 06:33

moodywoody

2,149
1
17
21

I tried using xml through sax and dom parsers but I am unable to acheive it. Actually its my project work and I have been told to use Xml for login authentication but I am not able to think of a way. – Poonam Hoshi Apr 02 '12 at 06:37

score 0 · Answer 3 · answered Apr 02 '12 at 06:35

Storing plain passwords -or even encoded ones- and retrieving them via a non-secured protocol and encryption is a terrible, terrible idea. The closest thing I can think of is SAML. Even in SAML it's recommended that you:

send the message through HTTPS,
encrypt it,
sign the XML and
encrypt the NameID (frequently a combination of the user ID and a session ID or token, which should expire after a short amount of time).

Never, I repeat never send the password. (Why do you need it anyway?) .

If you wanna learn more about SAML in Java, I'd recommend using OpenSAML and/or Shibboleth . The SAML Specification is here .

I'd also recommend you take a look at the OWASP project, just so you can speed up on security stuff.

Well its for my project and i have to make a demo. Actually I much prefered using mysql but my guide told me he dont want any database and try using xml for that purpose. Actually I am at my wits end. i tried many things but it still dont work. — Poonam Hoshi, Apr 02 '12 at 06:47

score 0 · Answer 4 · edited Jun 20 '20 at 09:12

0

You can do it. Here is an example how to read xml files in java. Again it is not a good idea.

edited Jun 20 '20 at 09:12

Community

1
1

answered Apr 02 '12 at 06:41

mbaydar

1,144
1
13
18

score 0 · Answer 5 · answered Apr 02 '12 at 06:44

0

I think this link will explain you how to read data from XML. All you need to do is to read the nodes and save it.

Another link

answered Apr 02 '12 at 06:44

Anuj Balan

7,629
23
58
92

score 0 · Answer 6 · answered Apr 02 '12 at 06:47

0

Storing passwords in plaintext is not recommended. Here is a simple API to read/write xml files in java.

SimpleXML

answered Apr 02 '12 at 06:47

Tito

8,894
12
52
86

Xml file for login authentication

6 Answers6