You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Steve Loughran (JIRA)" <ji...@apache.org> on 2018/03/29 10:34:00 UTC
[jira] [Commented] (HADOOP-15325) Make
Configuration#getPasswordFromCredentialsProvider() a public API
[ https://issues.apache.org/jira/browse/HADOOP-15325?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16418714#comment-16418714 ]
Steve Loughran commented on HADOOP-15325:
-----------------------------------------
I like the fallback mechanism, as the existing getPassword() method has been out in the wild for a long time. external libraries (e.g. google cloud services) will be using it, and switching to a new API hard.
Maybe make a policy enum of "allow", "warn", "fail"
> Make Configuration#getPasswordFromCredentialsProvider() a public API
> --------------------------------------------------------------------
>
> Key: HADOOP-15325
> URL: https://issues.apache.org/jira/browse/HADOOP-15325
> Project: Hadoop Common
> Issue Type: Improvement
> Components: conf
> Affects Versions: 2.6.0
> Reporter: Wei-Chiu Chuang
> Assignee: Zsolt Venczel
> Priority: Major
>
> HADOOP-10607 added a public API Configuration.getPassword() which reads passwords from credential provider and then falls back to reading from configuration if one is not available.
> This API has been used throughout Hadoop codebase and downstream applications. It is understandable for old password configuration keys to fallback to configuration to maintain backward compatibility. But for new configuration passwords that don't have legacy, there should be an option to _not_ fallback, because storing passwords in configuration is considered a bad security practice.
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
---------------------------------------------------------------------
To unsubscribe, e-mail: common-issues-unsubscribe@hadoop.apache.org
For additional commands, e-mail: common-issues-help@hadoop.apache.org