For OO concepts, the first couple chapters of Bruce Eckel's
Thinking in Java is good.
This id/passwords question intrigued me, so I sketched out some code as I started to think about which objects should provide which services. Maybe my code will get a discussion going. I'm a relative newbie, so I'd appreciate all comments, nitpicks, etc.
I decided not to worry about the GUI and just get some working business objects. The hooks are there for a GUI, though. Whatever launches the program would be responsible for calling "ProfilePool profilePool = ProfilePool.getInstance() ;" and the combination of the getUserProfile() method on ProfilePool and validatePassword() on UserProfile is the key to the whole thing -- you send an Id
String to getUserProfile to get a handle to a UserProfile, then use validatePassword to compare a potentially matching password string to the stored string for that UserProfile.
Caveats:
(1) I know close to nothing about security.
(2) I'd bet serialized objects in a file are a pretty unsecure way to store passwords. It's just the easiest way to
test this out without firing up a database. (I guess I could've done a flat file, but that's even uglier.)
(3) This is the first time I've used a HashSet, so all the stuff overriding equals() and hashCode() is pretty shaky.
(4) Of course in production code you're not going to have a public UserProfile.toString() that prints out the password!
(5) The fact that setPassword() on UserProfile doesn't trigger save() on ProfilePool is a major flaw in this (you don't see the bug until the second time you run the test). I guess I'd fix this with some sort of listener technique, but that's a project for another day.