Openfire (master)

• 

  Guus der Kinderen 27 Apr 2026 a3f388203cb9acf38eb29acb92bf92a27d19b405

  OF-3257/OF-3258 (code review): Spelling: 'nonexisting' -> 'nonexistent'

  • i18n/src/main/resources/openfire_i18n.properties (version a3f388203cb9acf38eb29acb92bf92a27d19b405)
  • i18n/src/main/resources/openfire_i18n_nl.properties (version a3f388203cb9acf38eb29acb92bf92a27d19b405)
  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version a3f388203cb9acf38eb29acb92bf92a27d19b405)
  • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerSaltTest.java (version a3f388203cb9acf38eb29acb92bf92a27d19b405)
• 

  Guus der Kinderen 27 Apr 2026 37847f59ecf08bbe7e3b0961025aedc84d473d46

  OF-3257/OF-3258 (code review): Prevent order-dependent failures by resetting the property after each test.

  • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerSaltTest.java (version 37847f59ecf08bbe7e3b0961025aedc84d473d46)
• 

  Guus der Kinderen 27 Apr 2026 392149534185eac2a45bd1fddccb9802a83daac1

  OF-3258 (code review): remove redundant whitespace

  • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerSaltTest.java (version 392149534185eac2a45bd1fddccb9802a83daac1)
• 

  Guus der Kinderen 27 Apr 2026 dd49e6f4a72e153e70fbdf723013f98022e44ef6

  OF-3258: Guard against user enumeration in ScramSha1SaslServer
  This replaces the use of randomly generated salts for unknown users with a deterministic but cryptographically unpredictable value derived from the username and a server-side secret.
  
  Prior to this change, a non-deterministic salt was used, which can be used (by retrieving it more than once) to determine if a user exists.

  • i18n/src/main/resources/openfire_i18n.properties (version dd49e6f4a72e153e70fbdf723013f98022e44ef6)
  • i18n/src/main/resources/openfire_i18n_nl.properties (version dd49e6f4a72e153e70fbdf723013f98022e44ef6)
  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version dd49e6f4a72e153e70fbdf723013f98022e44ef6)
  • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerSaltTest.java (version dd49e6f4a72e153e70fbdf723013f98022e44ef6)
• 

  Guus der Kinderen 27 Apr 2026 8ef647a8c44b1e74cc805662df3463b72b73f97b

  OF-3257/OF-3258 (code review): Guard against empty values for server secret constant
  Having an empty value for the server secret value is unlikely to happen, but should be replaced. This is an easy hardening with no downside.

  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version 8ef647a8c44b1e74cc805662df3463b72b73f97b)
• 

  Guus der Kinderen 27 Apr 2026 8f5b3e77298bf7bdc7f69e5f5be66e35bb8ef762

  OF-3257/OF-3258 (code review): Fix description of SERVER_SECRET_NONEXISTING_USERS
  The documentation for SERVER_SECRET_NONEXISTING_USERS incorrectly stated that the value is used for salt derivation only. In practice, this secret is used more broadly to derive deterministic, fake SCRAM credentials for non-existing users, including stored keys and server keys (and where applicable salt values).
  
  Update the Javadoc and i18n labels to accurately reflect this behavior.Additionally, document the effect of changing (rotating) this value.

  • i18n/src/main/resources/openfire_i18n.properties (version 8f5b3e77298bf7bdc7f69e5f5be66e35bb8ef762)
  • i18n/src/main/resources/openfire_i18n_nl.properties (version 8f5b3e77298bf7bdc7f69e5f5be66e35bb8ef762)
  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version 8f5b3e77298bf7bdc7f69e5f5be66e35bb8ef762)
• 

  Guus der Kinderen 27 Apr 2026 f1f5245f21d6c0676b5f4496f68506a6c0ba0e9e

  OF-3258 (code review): Fake salts should be similar in size to real ones
  The usage of fake salts is to avoid attackers to determine if a username exists. For this to work, the salts need to be indistinguishable from real ones. Using the same size for both helps.

  • xmppserver/src/main/java/org/jivesoftware/openfire/auth/DefaultAuthProvider.java (version f1f5245f21d6c0676b5f4496f68506a6c0ba0e9e)
  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version f1f5245f21d6c0676b5f4496f68506a6c0ba0e9e)
• 

  Guus der Kinderen 27 Apr 2026 f2b03b999e6974e52fa583e8f2400a3690e82417

  OF-3258 (code review): Guard against misbehaving AuthProviders
  When an AuthProvider cannot return a password, it should throw one of the exceptions defined in the contract, rather than return a null password.
  
  This change guards against misbehaving providers that return null, by interpreting null in the same way as a non-existent user and/or missing support for password retrieval.

  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version f2b03b999e6974e52fa583e8f2400a3690e82417)
• 

  Guus der Kinderen 27 Apr 2026 939df3c87aaf05aac0f716ea70b86d0a494c0254

  OF-3257/OF-3258: Improve one-time initialization of SERVER_SECRET_NONEXISTENT_USERS
  The previous method for one-time initialization of the SERVER_SECRET_NONEXISTENT_USERS property (which depended on a static initializer block) proved to be fragile.
  
  In this commit, initialization happens in a getter that should be used instead of directly accessing the property.

  • xmppserver/src/main/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServer.java (version 939df3c87aaf05aac0f716ea70b86d0a494c0254)
  • xmppserver/src/test/java/org/jivesoftware/openfire/sasl/ScramSha1SaslServerSaltTest.java (version 939df3c87aaf05aac0f716ea70b86d0a494c0254)