// Before returning, we pretend to evaluate the password.
// This helps prevent blackhats from discovering legal usernames
// by measuring how long password evaluation takes. For more context,
// see the 2012-02-22 comment on DERBY-5539.
//
PasswordHasher hasher = dd.makePasswordHasher( getDatabaseProperties() );
hasher.hashPasswordIntoString( userName, userPassword ).toCharArray();
return false;
}
PasswordHasher hasher = new PasswordHasher( userDescriptor.getHashingScheme() );
char[] candidatePassword = hasher.hashPasswordIntoString( userName, userPassword ).toCharArray();
char[] actualPassword = userDescriptor.getAndZeroPassword();
try {
if ( (candidatePassword == null) || (actualPassword == null)) { return false; }
if ( candidatePassword.length != actualPassword.length ) { return false; }