You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cloudstack.apache.org by "BryanMLima (via GitHub)" <gi...@apache.org> on 2024/05/16 19:54:16 UTC
[PR] Decrypt account and domain configurations when needed [cloudstack]
BryanMLima opened a new pull request, #9088:
URL: https://github.com/apache/cloudstack/pull/9088
### Description
This PR fixes an issue when using the LDAP integration with ACS. PR #6812 normalized the account and domain configurations to only encrypt the values with configurations in the `Hidden` and `Secure` categories. However, that PR failed to address the use of these configurations. This resulted in using the encrypted value of the configuration, when it should decrypt it first, as observed in issue #8637.
This problem was fixed by adding the method `getActualValue()` that checks if the configurations in the Account and Domain are in the `Hidden` and `Secure` categories, and decrypting it, if needed.
Fixes #8637
### Types of changes
- [ ] Breaking change (fix or feature that would cause existing functionality to change)
- [ ] New feature (non-breaking change which adds functionality)
- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] Enhancement (improves an existing feature and functionality)
- [ ] Cleanup (Code refactoring and cleanup, that may add test cases)
- [ ] build/CI
### Feature/Enhancement Scale or Bug Severity
#### Bug Severity
- [ ] BLOCKER
- [ ] Critical
- [ ] Major
- [x] Minor
- [ ] Trivial
### How Has This Been Tested?
In a lab with version 4.19.0 installed, I configured an LDAP server and tried to create and LDAP account, which resulted in the following error `LDAP: error code 49 - Invalid Credentials`. After applying the changes in this patch, no exception was thrown, and the accounts in the LDAP server were correctly listed.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2116085344
@BryanMLima a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123177217
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland merged PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2116252074
thanks @BryanMLima
For users who have fixed the issue by using plain password in the database, do they need to roll back to the encrypted value?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2126901516
<b>[SF] Trillian test result (tid-10256)</b>
Environment: kvm-rocky8 (x2), Advanced Networking with Mgmt server r8
Total time taken: 48610 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9088-t10256-kvm-rocky8.zip
Smoke tests completed. 130 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_events_resource | `Error` | 414.81 | test_events_resource.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "BryanMLima (via GitHub)" <gi...@apache.org>.
BryanMLima commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2122603183
> thanks @BryanMLima For users who have fixed the issue by using plain password in the database, do they need to roll back to the encrypted value?
@weizhouapache, yes, an exception will be thrown as ACS will try to decrypt a plain value. Therefore, users that changed to a plain value will need to manually update the password, via CloudMonkey, for example.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2124748129
@blueorangutan test rocky8 kvm-rocky8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2144693763
Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 9763
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2144529581
@DaanHoogland a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2124749425
@weizhouapache a [SL] Trillian-Jenkins test job (rocky8 mgmt + kvm-rocky8) has been kicked to run smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2116191815
Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 9624
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2124539873
<b>[SF] Trillian test result (tid-10233)</b>
Environment: kvm-centos7 (x2), Advanced Networking with Mgmt server 7
Total time taken: 50587 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9088-t10233-kvm-centos7.zip
Smoke tests completed. 127 look OK, 4 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_01_events_resource | `Error` | 417.97 | test_events_resource.py
test_02_trigger_shutdown | `Failure` | 341.70 | test_safe_shutdown.py
test_01_secure_vm_migration | `Error` | 135.30 | test_vm_life_cycle.py
test_01_secure_vm_migration | `Error` | 135.30 | test_vm_life_cycle.py
test_01_create_redundant_VPC_2tiers_4VMs_4IPs_4PF_ACL | `Failure` | 612.40 | test_vpc_redundant.py
test_02_redundant_VPC_default_routes | `Failure` | 982.59 | test_vpc_redundant.py
test_05_rvpc_multi_tiers | `Failure` | 636.10 | test_vpc_redundant.py
test_05_rvpc_multi_tiers | `Error` | 636.12 | test_vpc_redundant.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2122623765
> > thanks @BryanMLima For users who have fixed the issue by using plain password in the database, do they need to roll back to the encrypted value?
>
> @weizhouapache, yes, an exception will be thrown as ACS will try to decrypt a plain value. Therefore, users that changed to a plain value will need to manually update the password, via CloudMonkey, for example.
thanks for the clarification @BryanMLima
if possible, can you add the steps how to update the value via cloudmonkey or mysql in the description, in case the users have already changed it to a plain value ?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123178285
@weizhouapache a [SL] Jenkins job has been kicked to build packages. It will be bundled with KVM, XenServer and VMware SystemVM templates. I'll keep you posted as I make progress.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2144909366
@blueorangutan test alma9 kvm-alma9
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "BryanMLima (via GitHub)" <gi...@apache.org>.
BryanMLima commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2116081689
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2116137086
## [Codecov](https://app.codecov.io/gh/apache/cloudstack/pull/9088?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
Attention: Patch coverage is `0%` with `16 lines` in your changes are missing coverage. Please review.
> Project coverage is 15.66%. Comparing base [(`ea9a0f4`)](https://app.codecov.io/gh/apache/cloudstack/commit/ea9a0f4adf81b92abd7eddc4a6be57a131ef001b?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`9f4d800`)](https://app.codecov.io/gh/apache/cloudstack/pull/9088?dropdown=coverage&src=pr&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
| [Files](https://app.codecov.io/gh/apache/cloudstack/pull/9088?dropdown=coverage&src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Patch % | Lines |
|---|---|---|
| [...ava/com/cloud/domain/dao/DomainDetailsDaoImpl.java](https://app.codecov.io/gh/apache/cloudstack/pull/9088?src=pr&el=tree&filepath=engine%2Fschema%2Fsrc%2Fmain%2Fjava%2Fcom%2Fcloud%2Fdomain%2Fdao%2FDomainDetailsDaoImpl.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-ZW5naW5lL3NjaGVtYS9zcmMvbWFpbi9qYXZhL2NvbS9jbG91ZC9kb21haW4vZGFvL0RvbWFpbkRldGFpbHNEYW9JbXBsLmphdmE=) | 0.00% | [8 Missing :warning: ](https://app.codecov.io/gh/apache/cloudstack/pull/9088?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
| [...ain/java/com/cloud/user/AccountDetailsDaoImpl.java](https://app.codecov.io/gh/apache/cloudstack/pull/9088?src=pr&el=tree&filepath=engine%2Fschema%2Fsrc%2Fmain%2Fjava%2Fcom%2Fcloud%2Fuser%2FAccountDetailsDaoImpl.java&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#diff-ZW5naW5lL3NjaGVtYS9zcmMvbWFpbi9qYXZhL2NvbS9jbG91ZC91c2VyL0FjY291bnREZXRhaWxzRGFvSW1wbC5qYXZh) | 0.00% | [8 Missing :warning: ](https://app.codecov.io/gh/apache/cloudstack/pull/9088?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) |
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 4.19 #9088 +/- ##
============================================
+ Coverage 14.96% 15.66% +0.70%
+ Complexity 10995 10985 -10
============================================
Files 5373 5010 -363
Lines 469024 439856 -29168
Branches 58818 55500 -3318
============================================
- Hits 70197 68912 -1285
+ Misses 391056 363318 -27738
+ Partials 7771 7626 -145
```
| [Flag](https://app.codecov.io/gh/apache/cloudstack/pull/9088/flags?src=pr&el=flags&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | Coverage Δ | |
|---|---|---|
| [uitests](https://app.codecov.io/gh/apache/cloudstack/pull/9088/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `?` | |
| [unittests](https://app.codecov.io/gh/apache/cloudstack/pull/9088/flags?src=pr&el=flag&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) | `15.66% <0.00%> (-0.01%)` | :arrow_down: |
Flags with carried forward coverage won't be shown. [Click here](https://docs.codecov.io/docs/carryforward-flags?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache#carryforward-flags-in-the-pull-request-comment) to find out more.
</details>
[:umbrella: View full report in Codecov by Sentry](https://app.codecov.io/gh/apache/cloudstack/pull/9088?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123414115
@weizhouapache a [SL] Trillian-Jenkins test job (centos7 mgmt + kvm-centos7) has been kicked to run smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "BryanMLima (via GitHub)" <gi...@apache.org>.
BryanMLima commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2124715494
> clgtm, would these constructs have to be added to other scopes as well? i.e. move the code to the `GenercDaoBase` !?
Currently, there is no need, as the changes are only in respect to the removal of the `@Encrypt` annotation from Account and Domain details tables in PR #6812.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2146470069
<b>[SF] Trillian test result (tid-10333)</b>
Environment: kvm-alma9 (x2), Advanced Networking with Mgmt server a9
Total time taken: 54935 seconds
Marvin logs: https://github.com/blueorangutan/acs-prs/releases/download/trillian/pr9088-t10333-kvm-alma9.zip
Smoke tests completed. 130 look OK, 1 have errors, 0 did not run
Only failed and skipped tests results shown below:
Test | Result | Time (s) | Test File
--- | --- | --- | ---
test_list_system_vms_metrics_history | `Failure` | 0.23 | test_metrics_api.py
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2175519531
> > LGTM, couldn't test it locally but I'm happy with your testing @BryanMLima, would it be possible to document the changes in a doc-pr? https://github.com/apache/cloudstack-documentation
>
> @borisstoyanov, thanks for the review. Regarding the doc-pr, you mean creating instructions for the release notes, right?
Don't want to talk before my turn @BryanMLima , but yes, I am pretty sure that is what he means.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2144527739
@blueorangutan package
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "DaanHoogland (via GitHub)" <gi...@apache.org>.
DaanHoogland commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2124218868
> **NOTE:** For users that manually set the configurations `ldap.bind.password` and `ldap.truststore.password` to a plain value in order to fix the faulty behaviour, it is required to store them encrypted. It will not be possible to update the configuration via UI, as an exception will be thrown when ACS tries to decrypt the plain value. To fix this, it is required to set the password again for ACS to encrypt it. There are two options:
>
> * Manually set the configuration via CloudMonkey, for example `update configuration domainid=<domain-uuid> name="ldap.bind.password" value="password"`;
>
> * Or, removing the defined configuration through the database via the query `DELETE from cloud.domain_details WHERE name like "%ldap%password%"`, and setting the configuration via UI for the affected domains.
I think we need to add this to the release notes @BryanMLima
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123288655
Packaging result [SF]: ✔️ el7 ✔️ el8 ✔️ el9 ✔️ debian ✔️ suse15. SL-JID 9648
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "BryanMLima (via GitHub)" <gi...@apache.org>.
BryanMLima commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123050404
> > > thanks @BryanMLima For users who have fixed the issue by using plain password in the database, do they need to roll back to the encrypted value?
> >
> >
> > @weizhouapache, yes, an exception will be thrown as ACS will try to decrypt a plain value. Therefore, users that changed to a plain value will need to manually update the password, via CloudMonkey, for example.
>
> thanks for the clarification @BryanMLima if possible, can you add the steps how to update the value via cloudmonkey or mysql in the description, in case the users have already changed it to a plain value ?
Sure, no problem, I added in the description of the PR. The same instructions could be present in the release notes when upgrading to version `4.19.1.0`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "weizhouapache (via GitHub)" <gi...@apache.org>.
weizhouapache commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2123411755
@blueorangutan test
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "blueorangutan (via GitHub)" <gi...@apache.org>.
blueorangutan commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2144911444
@DaanHoogland a [SL] Trillian-Jenkins test job (alma9 mgmt + kvm-alma9) has been kicked to run smoke tests
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] Decrypt account and domain configurations when needed [cloudstack]
Posted by "BryanMLima (via GitHub)" <gi...@apache.org>.
BryanMLima commented on PR #9088:
URL: https://github.com/apache/cloudstack/pull/9088#issuecomment-2166627943
> LGTM, couldn't test it locally but I'm happy with your testing @BryanMLima, would it be possible to document the changes in a doc-pr? https://github.com/apache/cloudstack-documentation
@borisstoyanov, thanks for the review. Regarding the doc-pr, you mean creating instructions for the release notes, right?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@cloudstack.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org