You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@syncope.apache.org by il...@apache.org on 2026/09/10 12:22:08 UTC
(syncope) 02/02: Parameterize default credentials
This is an automated email from the ASF dual-hosted git repository.
ilgrosso pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 13df29e8415d00339a0c02cb470bf875b7c9f9a9
Author: Francesco Chicchiriccò <il...@apache.org>
AuthorDate: Thu Sep 10 14:00:01 2026 +0200
Parameterize default credentials
---
.../persistence/jpa/PersistenceTestContext.java | 3 ++-
.../persistence/neo4j/PersistenceTestContext.java | 3 ++-
core/spring/pom.xml | 4 ++--
.../spring/security/DefaultCredentialChecker.java | 27 +++++++++++-----------
.../core/spring/security/SecurityContext.java | 2 +-
.../META-INF/default-credentials.properties | 20 ++++++++++++++++
.../core/spring/SpringTestConfiguration.java | 2 +-
.../core/spring/security/DefaultEncryptorTest.java | 3 ++-
.../org/apache/syncope/fit/AbstractITCase.java | 10 +++++---
9 files changed, 50 insertions(+), 24 deletions(-)
diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
index 9f9aec48be..89753aef2f 100644
--- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
+++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java
@@ -19,6 +19,7 @@
package org.apache.syncope.core.persistence.jpa;
import jakarta.persistence.EntityManagerFactory;
+import java.io.IOException;
import javax.sql.DataSource;
import org.apache.commons.lang3.StringUtils;
import org.apache.syncope.common.keymaster.client.api.ConfParamOps;
@@ -118,7 +119,7 @@ public class PersistenceTestContext {
}
@Bean
- public EncryptorManager encryptorManager() {
+ public EncryptorManager encryptorManager() throws IOException {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
securityProperties.setProductionMode(false);
diff --git a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
index dd26b09595..75f7ddd762 100644
--- a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
+++ b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java
@@ -18,6 +18,7 @@
*/
package org.apache.syncope.core.persistence.neo4j;
+import java.io.IOException;
import javax.cache.CacheManager;
import javax.cache.Caching;
import org.apache.commons.lang3.StringUtils;
@@ -108,7 +109,7 @@ public class PersistenceTestContext {
}
@Bean
- public EncryptorManager encryptorManager() {
+ public EncryptorManager encryptorManager() throws IOException {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
securityProperties.setProductionMode(false);
diff --git a/core/spring/pom.xml b/core/spring/pom.xml
index 42c84cae8f..0af9c3ee2d 100644
--- a/core/spring/pom.xml
+++ b/core/spring/pom.xml
@@ -164,14 +164,14 @@ under the License.
<directory>src/main/resources</directory>
<filtering>true</filtering>
<includes>
- <include>**/security.properties</include>
+ <include>**/default-credentials.properties</include>
</includes>
</resource>
<resource>
<directory>src/main/resources</directory>
<filtering>false</filtering>
<excludes>
- <exclude>**/security.properties</exclude>
+ <exclude>**/default-credentials.properties</exclude>
</excludes>
</resource>
</resources>
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
index 84e4732a59..e0a8bc3e84 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java
@@ -18,6 +18,9 @@
*/
package org.apache.syncope.core.spring.security;
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.Properties;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;
@@ -32,27 +35,18 @@ public class DefaultCredentialChecker {
"The default AES key property is being used. "
+ "This must be changed to avoid a security breach!";
- private static final String DEFAULT_AES_KEY = "1abcdefghilmnopqrstuvz2!";
-
private static final String DEFAULT_JWS_KEY_ERROR_MESSAGE =
"The default JWKS key property is being used. "
+ "This must be changed to avoid a security breach!";
- private static final String DEFAULT_JWS_KEY = "ZW7pRixehFuNUtnY5Se47IemgMryTzazPPJ9CGX5LTCmsOJpOgHAQEuPQeV9A28f";
-
private static final String DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE =
"The default adminPassword property is being used. "
+ "This must be changed to avoid a security breach!";
- private static final String DEFAULT_ADMIN_PASSWORD =
- "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464";
-
private static final String DEFAULT_ANON_KEY_ERROR_MESSAGE =
"The default anonymousKey property is being used. "
+ "This must be changed to avoid a security breach!";
- private static final String DEFAULT_ANON_KEY = "anonymousKey";
-
private final boolean defaultAesKeyInUse;
private final boolean defaultJwsKeyInUse;
@@ -68,12 +62,17 @@ public class DefaultCredentialChecker {
final String jwsKey,
final String adminPassword,
final String anonymousKey,
- final boolean productionMode) {
+ final boolean productionMode) throws IOException {
+
+ try (InputStream in = getClass().getResourceAsStream("/META-INF/default-credentials.properties")) {
+ Properties defaultCredentials = new Properties();
+ defaultCredentials.load(in);
+ defaultAesKeyInUse = defaultCredentials.getProperty("default.aesSecretKey").equals(aesKey);
+ defaultJwsKeyInUse = defaultCredentials.getProperty("default.jwsKey").equals(jwsKey);
+ defaultAdminPasswordInUse = defaultCredentials.getProperty("default.adminPassword").equals(adminPassword);
+ defaultAnonymousKeyInUse = defaultCredentials.getProperty("default.anonymousKey").equals(anonymousKey);
+ }
- defaultAesKeyInUse = DEFAULT_AES_KEY.equals(aesKey);
- defaultJwsKeyInUse = DEFAULT_JWS_KEY.equals(jwsKey);
- defaultAdminPasswordInUse = DEFAULT_ADMIN_PASSWORD.equals(adminPassword);
- defaultAnonymousKeyInUse = DEFAULT_ANON_KEY.equals(anonymousKey);
this.productionMode = productionMode;
}
diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
index 7c41140def..3f14e9739c 100644
--- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
+++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java
@@ -120,7 +120,7 @@ public class SecurityContext {
@Bean
public DefaultCredentialChecker credentialChecker(
final SecurityProperties props,
- final JWSAlgorithm jwsAlgorithm) {
+ final JWSAlgorithm jwsAlgorithm) throws IOException {
return new DefaultCredentialChecker(
props.getAesSecretKey(),
diff --git a/core/spring/src/main/resources/META-INF/default-credentials.properties b/core/spring/src/main/resources/META-INF/default-credentials.properties
new file mode 100644
index 0000000000..8c96bdc4b6
--- /dev/null
+++ b/core/spring/src/main/resources/META-INF/default-credentials.properties
@@ -0,0 +1,20 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+default.aesSecretKey=${secretKey}
+default.jwsKey=${jwsKey}
+default.adminPassword=${adminPassword}
+default.anonymousKey=${anonymousKey}
diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
index 7d6d2d2757..11094b8ee3 100644
--- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
+++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java
@@ -47,7 +47,7 @@ public class SpringTestConfiguration {
}
@Bean
- public EncryptorManager encryptorManager() {
+ public EncryptorManager encryptorManager() throws IOException {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(AES_SECRET_KEY);
return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties);
diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
index 1ff092f3ca..07286aea44 100644
--- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
+++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java
@@ -24,6 +24,7 @@ import static org.junit.jupiter.api.Assertions.assertNotNull;
import static org.junit.jupiter.api.Assertions.assertThrows;
import static org.junit.jupiter.api.Assertions.assertTrue;
+import java.io.IOException;
import java.security.InvalidKeyException;
import org.apache.syncope.common.lib.types.CipherAlgorithm;
import org.apache.syncope.core.persistence.api.ApplicationContextProvider;
@@ -39,7 +40,7 @@ public class DefaultEncryptorTest {
private static Encryptor ENCRYPTOR;
@BeforeAll
- public static void setUp() {
+ public static void setUp() throws IOException {
SecurityProperties props = new SecurityProperties();
props.setAesSecretKey(SpringTestConfiguration.AES_SECRET_KEY);
ApplicationContextProvider.getBeanFactory().registerSingleton("securityProperties", props);
diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
index 01f2c2d65d..af674efe1e 100644
--- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
+++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java
@@ -1227,13 +1227,17 @@ public abstract class AbstractITCase {
@Autowired
protected DataSource testDataSource;
- protected final EncryptorManager encryptorManager;
+ protected EncryptorManager encryptorManager;
protected AbstractITCase() {
SecurityProperties securityProperties = new SecurityProperties();
securityProperties.setAesSecretKey(StringUtils.EMPTY);
securityProperties.setProductionMode(false);
- encryptorManager = new DefaultEncryptorManager(
- new DefaultCredentialChecker("", "", "", "", false), securityProperties);
+ try {
+ encryptorManager = new DefaultEncryptorManager(
+ new DefaultCredentialChecker("", "", "", "", false), securityProperties);
+ } catch (IOException e) {
+ fail(e.getMessage(), e);
+ }
}
}