You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2026/09/08 12:40:03 UTC
(syncope) 02/02: [SYNCOPE-1996] Security production mode
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch 4_1_X
in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 2894a9e7b21275bf9ba48a58d8d694b42b341eaa
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Tue Sep 8 14:39:48 2026 +0200
[SYNCOPE-1996] Security production mode
---
.../core/logic/UserSelfLogicPasswordResetTest.java | 1 +
.../persistence/jpa/PersistenceTestContext.java | 4 +-
.../persistence/neo4j/PersistenceTestContext.java | 4 +-
.../src/test/resources/core-test.properties | 1 +
.../spring/security/DefaultCredentialChecker.java | 63 ++++++++++++++++++----
.../core/spring/security/DefaultEncryptor.java | 49 +++++++++--------
.../spring/security/DefaultEncryptorManager.java | 14 ++++-
.../core/spring/security/SecurityContext.java | 59 +++++++++++++-------
.../core/spring/security/SecurityProperties.java | 10 ++++
.../core/spring/SpringTestConfiguration.java | 3 +-
.../core/spring/security/DefaultEncryptorTest.java | 11 +++-
core/starter/src/main/resources/core.properties | 1 +
.../src/main/resources/core-embedded.properties | 1 +
.../org/apache/syncope/fit/AbstractITCase.java | 5 +-
14 files changed, 167 insertions(+), 59 deletions(-)
diff --git a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/UserSelfLogicPasswordResetTest.java b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/UserSelfLogicPasswordResetTest.java
index 78fadb0577..94d9d979de 100644
--- a/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/UserSelfLogicPasswordResetTest.java
+++ b/core/idrepo/logic/src/test/java/org/apache/syncope/core/logic/UserSelfLogicPasswordResetTest.java
@@ -66,6 +66,7 @@ public class UserSelfLogicPasswordResetTest {
ConfParamOps confParamOps = mock(ConfParamOps.class);
userDAO = mock(UserDAO.class);
securityProperties = new SecurityProperties();
+ securityProperties.setProductionMode(false);
when(confParamOps.get(any(), eq(StandardConfParams.PASSWORD_RESET_ALLOWED), eq(false), eq(boolean.class))).
thenReturn(true);
diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
index a8995b97ab..9f9aec48be 100644
--- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
+++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
@@ -34,6 +34,7 @@ import org.apache.syncope.core.persistence.jpa.spring.CommonEntityManagerFactory
import org.apache.syncope.core.persistence.jpa.spring.DomainRoutingEntityManagerFactory;
import org.apache.syncope.core.provisioning.api.ConnectorManager;
import org.apache.syncope.core.provisioning.api.ImplementationLookup;
+import org.apache.syncope.core.spring.security.DefaultCredentialChecker;
import org.apache.syncope.core.spring.security.DefaultEncryptorManager;
import org.apache.syncope.core.spring.security.DefaultPasswordGenerator;
import org.apache.syncope.core.spring.security.PasswordGenerator;
@@ -120,7 +121,8 @@ public class PersistenceTestContext {
public EncryptorManager encryptorManager() {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
- return new DefaultEncryptorManager(securityProperties);
+ securityProperties.setProductionMode(false);
+ return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties);
}
@Bean
diff --git a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
index 29cb7fe845..dd26b09595 100644
--- a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
+++ b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
@@ -32,6 +32,7 @@ import org.apache.syncope.core.persistence.api.content.ContentLoader;
import org.apache.syncope.core.persistence.neo4j.spring.DomainRoutingDriver;
import org.apache.syncope.core.provisioning.api.ConnectorManager;
import org.apache.syncope.core.provisioning.api.ImplementationLookup;
+import org.apache.syncope.core.spring.security.DefaultCredentialChecker;
import org.apache.syncope.core.spring.security.DefaultEncryptorManager;
import org.apache.syncope.core.spring.security.DefaultPasswordGenerator;
import org.apache.syncope.core.spring.security.PasswordGenerator;
@@ -110,7 +111,8 @@ public class PersistenceTestContext {
public EncryptorManager encryptorManager() {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
- return new DefaultEncryptorManager(securityProperties);
+ securityProperties.setProductionMode(false);
+ return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties);
}
@Bean
diff --git a/core/provisioning-java/src/test/resources/core-test.properties b/core/provisioning-java/src/test/resources/core-test.properties
index 10da9c173c..c3e75041a9 100644
--- a/core/provisioning-java/src/test/resources/core-test.properties
+++ b/core/provisioning-java/src/test/resources/core-test.properties
@@ -15,6 +15,7 @@
# specific language governing permissions and limitations
# under the License.
+security.productionMode=false
security.adminUser=${adminUser}
security.anonymousUser=${anonymousUser}
security.jwsKey=${jwsKey}
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
index eef5fcb677..84e4732a59 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
@@ -28,43 +28,88 @@ public class DefaultCredentialChecker {
private static final Logger LOG = LoggerFactory.getLogger(DefaultCredentialChecker.class);
+ private static final String DEFAULT_AES_KEY_ERROR_MESSAGE =
+ "The default AES key property is being used. "
+ + "This must be changed to avoid a security breach!";
+
+ private static final String DEFAULT_AES_KEY = "1abcdefghilmnopqrstuvz2!";
+
+ private static final String DEFAULT_JWS_KEY_ERROR_MESSAGE =
+ "The default JWKS key property is being used. "
+ + "This must be changed to avoid a security breach!";
+
private static final String DEFAULT_JWS_KEY = "ZW7pRixehFuNUtnY5Se47IemgMryTzazPPJ9CGX5LTCmsOJpOgHAQEuPQeV9A28f";
+ private static final String DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE =
+ "The default adminPassword property is being used. "
+ + "This must be changed to avoid a security breach!";
+
private static final String DEFAULT_ADMIN_PASSWORD =
- "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464";
+ "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464";
+
+ private static final String DEFAULT_ANON_KEY_ERROR_MESSAGE =
+ "The default anonymousKey property is being used. "
+ + "This must be changed to avoid a security breach!";
private static final String DEFAULT_ANON_KEY = "anonymousKey";
- private final boolean defaultAdminPasswordInUse;
+ private final boolean defaultAesKeyInUse;
private final boolean defaultJwsKeyInUse;
+ private final boolean defaultAdminPasswordInUse;
+
private final boolean defaultAnonymousKeyInUse;
- public DefaultCredentialChecker(final String jwsKey, final String adminPassword, final String anonymousKey) {
+ private final boolean productionMode;
+
+ public DefaultCredentialChecker(
+ final String aesKey,
+ final String jwsKey,
+ final String adminPassword,
+ final String anonymousKey,
+ final boolean productionMode) {
+
+ defaultAesKeyInUse = DEFAULT_AES_KEY.equals(aesKey);
defaultJwsKeyInUse = DEFAULT_JWS_KEY.equals(jwsKey);
defaultAdminPasswordInUse = DEFAULT_ADMIN_PASSWORD.equals(adminPassword);
defaultAnonymousKeyInUse = DEFAULT_ANON_KEY.equals(anonymousKey);
+ this.productionMode = productionMode;
+ }
+
+ public void checkIsDefaultAESKeyInUse() {
+ if (defaultAesKeyInUse) {
+ if (productionMode) {
+ throw new IllegalStateException(DEFAULT_AES_KEY_ERROR_MESSAGE);
+ }
+ LOG.warn(DEFAULT_AES_KEY_ERROR_MESSAGE);
+ }
}
public void checkIsDefaultJWSKeyInUse() {
if (defaultJwsKeyInUse) {
- LOG.warn("The default jwsKey property is being used. "
- + "This must be changed to avoid a security breach!");
+ if (productionMode) {
+ throw new IllegalStateException(DEFAULT_JWS_KEY_ERROR_MESSAGE);
+ }
+ LOG.warn(DEFAULT_JWS_KEY_ERROR_MESSAGE);
}
}
public void checkIsDefaultAdminPasswordInUse() {
if (defaultAdminPasswordInUse) {
- LOG.warn("The default adminPassword property is being used. "
- + "This must be changed to avoid a security breach!");
+ if (productionMode) {
+ throw new IllegalStateException(DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE);
+ }
+ LOG.warn(DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE);
}
}
public void checkIsDefaultAnonymousKeyInUse() {
if (defaultAnonymousKeyInUse) {
- LOG.warn("The default anonymousKey property is being used. "
- + "This must be changed to avoid a security breach!");
+ if (productionMode) {
+ throw new IllegalStateException(DEFAULT_ANON_KEY_ERROR_MESSAGE);
+ }
+ LOG.warn(DEFAULT_ANON_KEY_ERROR_MESSAGE);
}
}
}
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptor.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptor.java
index 7b0824ba87..e415306134 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptor.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptor.java
@@ -51,6 +51,7 @@ public class DefaultEncryptor implements Encryptor {
protected DefaultEncryptor(
final String aesSecretKey,
+ final boolean productionMode,
final SecurityProperties.DigesterProperties digesterProperties) {
this.digesterProperties = digesterProperties;
@@ -60,30 +61,34 @@ public class DefaultEncryptor implements Encryptor {
if (StringUtils.isNotBlank(aesSecretKey)) {
String actualKey = aesSecretKey;
- Integer pad = null;
- boolean truncate = false;
- if (actualKey.length() < 16) {
- pad = 16 - actualKey.length();
- } else if (actualKey.length() > 16 && actualKey.length() < 24) {
- pad = 24 - actualKey.length();
- } else if (actualKey.length() > 24 && actualKey.length() < 32) {
- pad = 32 - actualKey.length();
- } else if (actualKey.length() > 32) {
- truncate = true;
- }
+ if (!productionMode) {
+ Integer pad = null;
+ boolean truncate = false;
+ if (actualKey.length() < 16) {
+ pad = 16 - actualKey.length();
+ } else if (actualKey.length() > 16 && actualKey.length() < 24) {
+ pad = 24 - actualKey.length();
+ } else if (actualKey.length() > 24 && actualKey.length() < 32) {
+ pad = 32 - actualKey.length();
+ } else if (actualKey.length() > 32) {
+ truncate = true;
+ }
- if (pad != null) {
- StringBuilder actualKeyPadding = new StringBuilder(actualKey);
- String randomChars = SecureRandomUtils.generateRandomPassword(pad);
+ if (pad != null) {
+ StringBuilder actualKeyPadding = new StringBuilder(actualKey);
+ String randomChars = SecureRandomUtils.generateRandomPassword(pad);
- actualKeyPadding.append(randomChars);
- actualKey = actualKeyPadding.toString();
- LOG.warn("The configured AES secret key is too short (< {}), padding with random chars: {}",
- actualKey.length(), actualKey);
- }
- if (truncate) {
- actualKey = actualKey.substring(0, 32);
- LOG.warn("The configured AES secret key is too long (> 32), truncating: {}", actualKey);
+ actualKeyPadding.append(randomChars);
+ actualKey = actualKeyPadding.toString();
+ LOG.warn("The configured AES secret key is too short (< {}), padding with random chars",
+ actualKey.length());
+ LOG.debug("Using\nsecurity.aesSecretKey={}", actualKey);
+ }
+ if (truncate) {
+ actualKey = actualKey.substring(0, 32);
+ LOG.warn("The configured AES secret key is too long (> 32), truncating");
+ LOG.debug("Using\nsecurity.aesSecretKey={}", actualKey);
+ }
}
try {
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptorManager.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptorManager.java
index f0d5776f78..1cee4bdeaf 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptorManager.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultEncryptorManager.java
@@ -26,11 +26,17 @@ import org.apache.syncope.core.persistence.api.EncryptorManager;
public class DefaultEncryptorManager implements EncryptorManager {
+ protected final DefaultCredentialChecker credentialChecker;
+
protected final SecurityProperties securityProperties;
protected final Map<String, DefaultEncryptor> instances = new ConcurrentHashMap<>();
- public DefaultEncryptorManager(final SecurityProperties securityProperties) {
+ public DefaultEncryptorManager(
+ final DefaultCredentialChecker credentialChecker,
+ final SecurityProperties securityProperties) {
+
+ this.credentialChecker = credentialChecker;
this.securityProperties = securityProperties;
}
@@ -41,7 +47,11 @@ public class DefaultEncryptorManager implements EncryptorManager {
@Override
public Encryptor getInstance(final String aesSecretKey) {
+ credentialChecker.checkIsDefaultAESKeyInUse();
+
String actualKey = StringUtils.isBlank(aesSecretKey) ? securityProperties.getAesSecretKey() : aesSecretKey;
- return instances.computeIfAbsent(actualKey, k -> new DefaultEncryptor(k, securityProperties.getDigester()));
+ return instances.computeIfAbsent(
+ actualKey,
+ k -> new DefaultEncryptor(k, securityProperties.isProductionMode(), securityProperties.getDigester()));
}
}
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
index cc0bd75b71..7c41140def 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
@@ -65,31 +65,45 @@ public class SecurityContext {
private static final Logger LOG = LoggerFactory.getLogger(SecurityContext.class);
+ private static String JWS_KEY = null;
+
@Role(BeanDefinition.ROLE_INFRASTRUCTURE)
@Bean
public static GrantedAuthorityDefaults grantedAuthorityDefaults() {
return new GrantedAuthorityDefaults(""); // Remove the ROLE_ prefix
}
- protected static String jwsKey(final JWSAlgorithm jwsAlgorithm, final SecurityProperties props) {
- String jwsKey = Optional.ofNullable(props.getJwsKey()).
- orElseThrow(() -> new IllegalArgumentException("No JWS key provided"));
-
- if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
- int minLength = jwsAlgorithm.equals(JWSAlgorithm.HS256)
- ? 256 / 8
- : jwsAlgorithm.equals(JWSAlgorithm.HS384)
- ? 384 / 8
- : 512 / 8;
- if (jwsKey.length() < minLength) {
- jwsKey = SecureRandomUtils.generateRandomPassword(minLength);
- props.setJwsKey(jwsKey);
- LOG.warn("The configured key for {} must be at least {} bits, generating random: {}",
- jwsAlgorithm, minLength * 8, jwsKey);
+ private static String jwsKey(final JWSAlgorithm jwsAlgorithm, final SecurityProperties props) {
+ synchronized (LOG) {
+ if (JWS_KEY == null) {
+ String jwsKey = Optional.ofNullable(props.getJwsKey()).
+ orElseThrow(() -> new IllegalArgumentException("No JWS key provided"));
+
+ if (JWSAlgorithm.Family.HMAC_SHA.contains(jwsAlgorithm)) {
+ int minLength = jwsAlgorithm.equals(JWSAlgorithm.HS256)
+ ? 256 / 8
+ : jwsAlgorithm.equals(JWSAlgorithm.HS384)
+ ? 384 / 8
+ : 512 / 8;
+ if (jwsKey.length() < minLength) {
+ if (props.isProductionMode()) {
+ throw new IllegalArgumentException(
+ "The configured key for %s must be at least %d characters".
+ formatted(jwsAlgorithm, minLength));
+ }
+
+ jwsKey = SecureRandomUtils.generateRandomPassword(minLength);
+ props.setJwsKey(jwsKey);
+ LOG.warn("The configured key for {} must be at least {} characters, generating random",
+ jwsAlgorithm, minLength);
+ LOG.debug("Using\nsecurity.jwsKey={}", jwsKey);
+ }
+ }
+
+ JWS_KEY = jwsKey;
}
}
-
- return jwsKey;
+ return JWS_KEY;
}
@Bean
@@ -109,9 +123,11 @@ public class SecurityContext {
final JWSAlgorithm jwsAlgorithm) {
return new DefaultCredentialChecker(
+ props.getAesSecretKey(),
jwsKey(jwsAlgorithm, props),
props.getAdminPassword(),
- props.getAnonymousKey());
+ props.getAnonymousKey(),
+ props.isProductionMode());
}
@ConditionalOnMissingBean
@@ -164,8 +180,11 @@ public class SecurityContext {
}
@Bean
- public EncryptorManager encryptorManager(final SecurityProperties securityProperties) {
- return new DefaultEncryptorManager(securityProperties);
+ public EncryptorManager encryptorManager(
+ final DefaultCredentialChecker credentialChecker,
+ final SecurityProperties securityProperties) {
+
+ return new DefaultEncryptorManager(credentialChecker, securityProperties);
}
@ConditionalOnMissingBean
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java
index f444717a3e..d41b3e0923 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityProperties.java
@@ -150,6 +150,8 @@ public class SecurityProperties {
}
}
+ private boolean productionMode = true;
+
private String adminUser;
private String adminPassword;
@@ -182,6 +184,14 @@ public class SecurityProperties {
private final DigesterProperties digester = new DigesterProperties();
+ public boolean isProductionMode() {
+ return productionMode;
+ }
+
+ public void setProductionMode(final boolean productionMode) {
+ this.productionMode = productionMode;
+ }
+
public String getAdminUser() {
return adminUser;
}
diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
index 82313849c4..7d6d2d2757 100644
--- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
+++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
@@ -25,6 +25,7 @@ import java.io.Reader;
import org.apache.syncope.core.persistence.api.ApplicationContextProvider;
import org.apache.syncope.core.persistence.api.EncryptorManager;
import org.apache.syncope.core.provisioning.api.ImplementationLookup;
+import org.apache.syncope.core.spring.security.DefaultCredentialChecker;
import org.apache.syncope.core.spring.security.DefaultEncryptorManager;
import org.apache.syncope.core.spring.security.DummyImplementationLookup;
import org.apache.syncope.core.spring.security.SecurityProperties;
@@ -49,7 +50,7 @@ public class SpringTestConfiguration {
public EncryptorManager encryptorManager() {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(AES_SECRET_KEY);
- return new DefaultEncryptorManager(securityProperties);
+ return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties);
}
@Primary
diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
index bba0d18cf9..1ff092f3ca 100644
--- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
+++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
@@ -21,8 +21,10 @@ package org.apache.syncope.core.spring.security;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.security.InvalidKeyException;
import org.apache.syncope.common.lib.types.CipherAlgorithm;
import org.apache.syncope.core.persistence.api.ApplicationContextProvider;
import org.apache.syncope.core.persistence.api.Encryptor;
@@ -44,7 +46,9 @@ public class DefaultEncryptorTest {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(SpringTestConfiguration.AES_SECRET_KEY);
- ENCRYPTOR = new DefaultEncryptorManager(securityProperties).getInstance();
+
+ ENCRYPTOR = new DefaultEncryptorManager(
+ new DefaultCredentialChecker("", "", "", "", false), securityProperties).getInstance();
}
@Test
@@ -74,7 +78,10 @@ public class DefaultEncryptorTest {
@Test
public void smallKey() throws Exception {
- DefaultEncryptor smallKeyEncryptor = new DefaultEncryptor("123", new SecurityProperties().getDigester());
+ DefaultEncryptor prodModeEncryptor = new DefaultEncryptor("123", true, new SecurityProperties().getDigester());
+ assertThrows(InvalidKeyException.class, () -> prodModeEncryptor.encode(PASSWORD_VALUE, CipherAlgorithm.AES));
+
+ DefaultEncryptor smallKeyEncryptor = new DefaultEncryptor("123", false, new SecurityProperties().getDigester());
String encPassword = smallKeyEncryptor.encode(PASSWORD_VALUE, CipherAlgorithm.AES);
String decPassword = smallKeyEncryptor.decode(encPassword, CipherAlgorithm.AES);
assertEquals(PASSWORD_VALUE, decPassword);
diff --git a/core/starter/src/main/resources/core.properties b/core/starter/src/main/resources/core.properties
index e9dfe4650b..c3638aa1d9 100644
--- a/core/starter/src/main/resources/core.properties
+++ b/core/starter/src/main/resources/core.properties
@@ -80,6 +80,7 @@ spring.mail.properties.mail.smtp.starttls.enable=false
# Security #
############
+security.productionMode=true
security.adminUser=${adminUser}
security.adminPassword=${adminPassword}
security.adminPasswordAlgorithm=SSHA256
diff --git a/fit/core-reference/src/main/resources/core-embedded.properties b/fit/core-reference/src/main/resources/core-embedded.properties
index 243f8c42dc..e030e8d2f0 100644
--- a/fit/core-reference/src/main/resources/core-embedded.properties
+++ b/fit/core-reference/src/main/resources/core-embedded.properties
@@ -27,6 +27,7 @@ service.discovery.address=http://localhost:9080/syncope/rest/
spring.devtools.livereload.enabled=false
spring.devtools.restart.enabled=false
+security.productionMode=false
security.adminUser=${adminUser}
security.anonymousUser=${anonymousUser}
security.jwsKey=${jwsKey}
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index 3c1f5912a5..d22ce6c0ae 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -175,6 +175,7 @@ import org.apache.syncope.common.rest.api.service.wa.MfaTrustStorageService;
import org.apache.syncope.common.rest.api.service.wa.WAConfigService;
import org.apache.syncope.common.rest.api.service.wa.WebAuthnRegistrationService;
import org.apache.syncope.core.persistence.api.EncryptorManager;
+import org.apache.syncope.core.spring.security.DefaultCredentialChecker;
import org.apache.syncope.core.spring.security.DefaultEncryptorManager;
import org.apache.syncope.core.spring.security.SecurityProperties;
import org.apache.syncope.fit.AbstractITCase.KeymasterInitializer;
@@ -1189,6 +1190,8 @@ public abstract class AbstractITCase {
protected AbstractITCase() {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
- encryptorManager = new DefaultEncryptorManager(securityProperties);
+ securityProperties.setProductionMode(false);
+ encryptorManager = new DefaultEncryptorManager(
+ new DefaultCredentialChecker("", "", "", "", false), securityProperties);
}
}