I’ve completed internships at IBM and Infosys Springboard focused on REST API
development and endpoint security. My project MedVault is a healthcare platform
with Spring Security-based RBAC, JWT auth, and AOP audit logging.
Project: Password Authentication Re-work
Problem Statement
OpenMRS’s password system hasn’t been updated since ~2009. It lacks:
Configurable work factors / hash iterations
Support for modern algorithms (BCrypt, Argon2)
Integration with Spring Security’s PasswordEncoder abstraction
A safe upgrade path for existing hashed passwords
Proposed Solution
Audit current password handling in UserServiceImpl
Migrate to Spring Security PasswordEncoder (BCrypt default)
Implement transparent re-hashing on successful login
Optionally: build on top of the existing authentication module
for TOTP/MFA readiness
Full test coverage — no existing user should be locked out
Timeline (12 weeks)
Week 1-2: Community bonding, codebase audit, JIRA setup
Week 3-4: Design doc, community review, finalize approach
Week 5-7: Core PasswordEncoder migration + unit tests
Spring Security is my primary domain. I’ve implemented JWT pipelines,
secured 10+ endpoints with role-based access, and dealt with auth
upgrade paths in production-like environments.
Questions for the Community
Is there an existing JIRA ticket or prior discussion on this I should link?
Should this be scoped as small (~90h) or medium (~175h)?
What good-first-issue would you recommend to get started before March 28?
Hi @wedson! No, this isn’t the proposal itself — this is my introduction post to connect with the OpenMRS community and find a mentor before the application period closes.
The actual GSoC proposal will be submitted on the official Google Summer of Code portal (summerofcode.withgoogle.com) before the deadline. I’m currently working on the full proposal draft for the “Password Authentication Re-work” project.
Happy to share more details about the idea if you’re interested!
Thanks Elvis! I found the template and I’m working through it now.
Quick q: should the “Problem Statement” section reference the OpenMRS
documentation you linked, or do you want proof-of-concept code showing
the current auth flow first?
Hi @Emmanuel Nyachoke — I saw you’re the assigned mentor for the Password Authentication Re-work idea this year and wanted to reach out directly before the submission deadline (March 31).
I’ve been working on this project for a few weeks and have already built a working PoC:
……thank you, Actually I asked thinking It was your proposal and yet it should be private you and your mentor