Remove Md5PasswordEncoder from core

Issue: gh-4674

config/src/main/java/org/springframework/security/config/authentication/PasswordEncoderParser.java

@@ -29,7 +29,6 @@ import org.springframework.beans.factory.xml.ParserContext;
 import org.springframework.security.authentication.encoding.BaseDigestPasswordEncoder;
 import org.springframework.security.authentication.encoding.LdapShaPasswordEncoder;
 import org.springframework.security.authentication.encoding.Md4PasswordEncoder;
-import org.springframework.security.authentication.encoding.Md5PasswordEncoder;
 import org.springframework.security.authentication.encoding.PlaintextPasswordEncoder;
 import org.springframework.security.authentication.encoding.ShaPasswordEncoder;
 import org.springframework.security.config.Elements;
@@ -54,7 +53,6 @@ public class PasswordEncoderParser {
 	static final String OPT_HASH_SHA = "sha";
 	static final String OPT_HASH_SHA256 = "sha-256";
 	static final String OPT_HASH_MD4 = "md4";
-	static final String OPT_HASH_MD5 = "md5";
 	static final String OPT_HASH_LDAP_SHA = "{sha}";
 	static final String OPT_HASH_LDAP_SSHA = "{ssha}";
 
@@ -67,7 +65,6 @@ public class PasswordEncoderParser {
 		ENCODER_CLASSES.put(OPT_HASH_SHA, ShaPasswordEncoder.class);
 		ENCODER_CLASSES.put(OPT_HASH_SHA256, ShaPasswordEncoder.class);
 		ENCODER_CLASSES.put(OPT_HASH_MD4, Md4PasswordEncoder.class);
-		ENCODER_CLASSES.put(OPT_HASH_MD5, Md5PasswordEncoder.class);
 		ENCODER_CLASSES.put(OPT_HASH_LDAP_SHA, LdapShaPasswordEncoder.class);
 		ENCODER_CLASSES.put(OPT_HASH_LDAP_SSHA, LdapShaPasswordEncoder.class);
 	}

config/src/main/resources/org/springframework/security/config/spring-security-5.0.rnc

@@ -7,7 +7,7 @@ start = http | ldap-server | authentication-provider | ldap-authentication-provi
 
 hash =
 	## Defines the hashing algorithm used on user passwords. Bcrypt is recommended.
-	attribute hash {"bcrypt" | "plaintext" | "sha" | "sha-256" | "md5" | "md4" | "{sha}" | "{ssha}"}
+	attribute hash {"bcrypt" | "plaintext" | "sha" | "sha-256" | "md4" | "{sha}" | "{ssha}"}
 base64 =
 	## Whether a string should be base64 encoded
 	attribute base64 {xsd:boolean}

config/src/main/resources/org/springframework/security/config/spring-security-5.0.xsd

@@ -15,7 +15,6 @@
                <xs:enumeration value="plaintext"/>
                <xs:enumeration value="sha"/>
                <xs:enumeration value="sha-256"/>
-               <xs:enumeration value="md5"/>
                <xs:enumeration value="md4"/>
                <xs:enumeration value="{sha}"/>
                <xs:enumeration value="{ssha}"/>
@@ -150,7 +149,6 @@
                <xs:enumeration value="plaintext"/>
                <xs:enumeration value="sha"/>
                <xs:enumeration value="sha-256"/>
-               <xs:enumeration value="md5"/>
                <xs:enumeration value="md4"/>
                <xs:enumeration value="{sha}"/>
                <xs:enumeration value="{ssha}"/>
@@ -533,7 +531,6 @@
                <xs:enumeration value="plaintext"/>
                <xs:enumeration value="sha"/>
                <xs:enumeration value="sha-256"/>
-               <xs:enumeration value="md5"/>
                <xs:enumeration value="md4"/>
                <xs:enumeration value="{sha}"/>
                <xs:enumeration value="{ssha}"/>

config/src/test/java/org/springframework/security/config/authentication/AuthenticationProviderBeanDefinitionParserTests.java

@@ -24,6 +24,7 @@ import org.springframework.security.authentication.dao.ReflectionSaltSource;
 import org.springframework.security.authentication.encoding.ShaPasswordEncoder;
 import org.springframework.security.config.BeanIds;
 import org.springframework.security.config.util.InMemoryXmlApplicationContext;
+import org.springframework.security.crypto.password.MessageDigestPasswordEncoder;
 import org.springframework.security.util.FieldUtils;
 import org.springframework.beans.factory.parsing.BeanDefinitionParsingException;
 import org.springframework.context.support.AbstractXmlApplicationContext;
@@ -103,11 +104,19 @@ public class AuthenticationProviderBeanDefinitionParserTests {
 
 	@Test
 	public void providerWithMd5PasswordEncoderWorks() throws Exception {
-		setContext(" <authentication-provider>"
-				+ "        <password-encoder hash='md5'/>"
+		appContext = new InMemoryXmlApplicationContext(
+				" <authentication-manager>"
+				+ " <authentication-provider>"
+				+ "        <password-encoder ref='passwordEncoder'/>"
 				+ "        <user-service>"
 				+ "            <user name='bob' password='12b141f35d58b8b3a46eea65e6ac179e' authorities='ROLE_A' />"
-				+ "        </user-service>" + "    </authentication-provider>");
+				+ "        </user-service>"
+				+ "    </authentication-provider>"
+				+ " </authentication-manager>"
+				+ " <b:bean id='passwordEncoder'  class='"
+				+ MessageDigestPasswordEncoder.class.getName() + "'>"
+				+ "     <b:constructor-arg value='MD5'/>"
+				+ " </b:bean>");
 
 		getProvider().authenticate(bob);
 	}
@@ -138,45 +147,24 @@ public class AuthenticationProviderBeanDefinitionParserTests {
 
 	@Test
 	public void passwordIsBase64EncodedWhenBase64IsEnabled() throws Exception {
-		setContext(" <authentication-provider>"
-				+ "        <password-encoder hash='md5' base64='true'/>"
+		appContext = new InMemoryXmlApplicationContext(
+				" <authentication-manager>"
+				+ " <authentication-provider>"
+				+ "        <password-encoder ref='passwordEncoder'/>"
 				+ "        <user-service>"
 				+ "            <user name='bob' password='ErFB811YuLOkbupl5qwXng==' authorities='ROLE_A' />"
-				+ "        </user-service>" + "    </authentication-provider>");
+				+ "        </user-service>"
+				+ "    </authentication-provider>"
+				+ " </authentication-manager>"
+				+ " <b:bean id='passwordEncoder'  class='"
+				+ MessageDigestPasswordEncoder.class.getName() + "'>"
+				+ "     <b:constructor-arg value='MD5'/>"
+				+ "     <b:property name='encodeHashAsBase64' value='true'/>"
+				+ " </b:bean>");
 
 		getProvider().authenticate(bob);
 	}
 
-	@Test
-	public void externalUserServicePasswordEncoderAndSaltSourceWork() throws Exception {
-		appContext = new InMemoryXmlApplicationContext(
-				"    <authentication-manager>"
-						+ "      <authentication-provider user-service-ref='customUserService'>"
-						+ "        <password-encoder ref='customPasswordEncoder'>"
-						+ "            <salt-source ref='saltSource'/>"
-						+ "        </password-encoder>"
-						+ "      </authentication-provider>"
-						+ "    </authentication-manager>"
-						+
-
-						"    <b:bean id='customPasswordEncoder' "
-						+ "class='org.springframework.security.authentication.encoding.Md5PasswordEncoder'/>"
-						+ "    <b:bean id='saltSource' "
-						+ "           class='"
-						+ ReflectionSaltSource.class.getName()
-						+ "'>"
-						+ "         <b:property name='userPropertyToUse' value='username'/>"
-						+ "    </b:bean>"
-						+ "    <b:bean id='customUserService' "
-						+ "           class='org.springframework.security.provisioning.InMemoryUserDetailsManager'>"
-						+ "        <b:constructor-arg>"
-						+ "            <b:props>"
-						+ "                <b:prop key='bob'>f117f0862384e9497ff4f470e3522606,ROLE_A</b:prop>"
-						+ "            </b:props>" + "        </b:constructor-arg>"
-						+ "    </b:bean>");
-		getProvider().authenticate(bob);
-	}
-
 	// SEC-1466
 	@Test(expected = BeanDefinitionParsingException.class)
 	public void exernalProviderDoesNotSupportChildElements() throws Exception {