# Error in Custom Realm X-Pack Oauth

**URL:** <https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723>\
**Category:** Elasticsearch\
**Created:** [March 13, 2018, 11:48am UTC](https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723 "2018-03-13T11:48:05Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)\
**Post date:** [March 13, 2018, 11:48am UTC](https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723/1 "2018-03-13T11:48:05Z")

</div>

After changing version from 5.4.1 to 5.5.1 I am getting Exception in below method

@override  
public User authenticate(AuthenticationToken authenticationToken) {  
UsernamePasswordToken token = (UsernamePasswordToken) authenticationToken;  
final String actualUser = token.principal();  
final InfoHolder info = usersMap.get(actualUser);

```
if (info != null && SecuredString.constantTimeEquals(token.credentials(), info.password)) {
    return new User(actualUser, info.roles);
}
return null;

```

}  
Error is:

[INFO] BUILD FAILURE  
[INFO] ------------------------------------------------------------------------  
[INFO] Total time: 39.197 s  
[INFO] Finished at: 2018-03-13T14:25:24+05:30  
[INFO] Final Memory: 25M/66M  
[INFO] ------------------------------------------------------------------------  
[ERROR] Failed to execute goal org.apache.maven.plugins:maven-compiler-plugin:2.5:compile (default-compile) on project shieldOAuth: Compilation failure: Compilation failure:  
[ERROR] D:...\x-pack-custom-realm\src\main\java\org\elasticsearch\example\realm\CustomRealm.java:[30,53] error: cannot find symbol  
[ERROR] symbol: class SecuredString  
[ERROR] location: package org.elasticsearch.xpack.security.authc.support  
[ERROR] D:...\x-pack-custom-realm\src\main\java\org\elasticsearch\example\realm\CustomCachingRealm.java:[26,53] error: cannot find symbol  
[ERROR] -\> [Help 1]  
[ERROR]

Secured class in not available in other ES versions What should I use instead of  
SecuredString.constantTimeEquals(token.credentials(), info.password)

Please suggest what to do in this case?

---

<div class="post-metadata">

**Author:** ![TimV](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/timv/32/13162_2.png) [@TimV](https://discuss.elastic.co/u/TimV)\
**Post date:** [March 14, 2018, 4:46am UTC](https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723/2 "2018-03-14T04:46:21Z")

</div>

In 5.5 the xpack SecuredString was replaced with `org.elasticsearch.common.settings.SecureString`, for which the equals method is constant time.

The 5.5 branch of the sample code has this change

> <https://github.com/elastic/shield-custom-realm-example/blob/5.5/src/main/java/org/elasticsearch/example/realm/CustomRealm.java>

---

<div class="post-metadata">

**Author:** ![PinkiMondal](https://avatars.discourse-cdn.com/v4/letter/p/a698b9/32.png) [@PinkiMondal](https://discuss.elastic.co/u/PinkiMondal)\
**Post date:** [March 14, 2018, 5:47am UTC](https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723/3 "2018-03-14T05:47:43Z")

</div>

> [@PinkiMondal](#):
>
> SecuredString.constantTimeEquals(token.credentials(), info.password)

Please tell what to use in place of this

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [April 11, 2018, 5:48am UTC](https://discuss.elastic.co/t/error-in-custom-realm-x-pack-oauth/123723/4 "2018-04-11T05:48:28Z")

</div>

Closed on April 11, 2018, 5:48am UTC

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.