Intercepting j_username, j_password for server side password validations

[mandeep_aj]

Hi, 

My use case is such that I need to allow users to login (authenticated via j_security) , post which I need to identify if passwords are weak and make users change them. 

Is there any API that allows decrypted user password to be fetched from JCR ? Or any other idea how this can be achieved. 

[smacdonald2008]

See this AEM Ask the Community Experts where Justin talks about this. 

https://helpx.adobe.com/experience-manager/using/secure_sites.html

The link to the webinar is at the start of the article. 

[Ashwin_Raju]

Please refer to https://docs.adobe.com/docs/en/spec/jsr170/javadocs/jcr-1.0/javax/jcr/SimpleCredentials.html#getPass...()

Also - http://www.programcreek.com/java-api-examples/index.php?api=javax.jcr.SimpleCredentials

Please revert if my response didn't help or mark answered if it helped!

Regards,

Ashwin Raju

[kautuk_sahni · Accepted solution]

Hi 

Please have a look at this Adobe community GEM session

Link:- https://communities.adobe.com/content/dam/cush/aem_technologistsdevelopersarchitects/AEMTechnologist...

// This will walk you through a presentation and demo on developing secure AEM web sites that require user authentication. This session will provide you with a deeper understanding of how to build AEM secure web site by using Sling technology.

~kautuk