You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dolphinscheduler.apache.org by "hdygxsj (via GitHub)" <gi...@apache.org> on 2024/08/15 15:11:59 UTC
[I] [DSIP] [Security] Support using encryption algorithms to encrypt the passwords entered by users in DS. [dolphinscheduler]
hdygxsj opened a new issue, #16473:
URL: https://github.com/apache/dolphinscheduler/issues/16473
### Search before asking
- [X] I had searched in the [DSIP](https://github.com/apache/dolphinscheduler/issues/14102) and found no similar DSIP.
### Motivation
In DolphinScheduler, many places require the maintenance of various passwords, such as passwords in the data source center, and passwords for catalogs and databases within SQLs. Some companies have mandatory requirements for the encryption algorithms used in software, and there may even be a need to use internal encryption algorithms specific to the company. This DSIP can enhance the security of DolphinScheduler.
### Design Detail
Common cryptographic algorithms include hash (digest) algorithms and symmetric encryption algorithms, among others. Hash algorithms are primarily used for verifying user login passwords, while symmetric encryption algorithms are used for encrypting and decrypting database passwords entered by users, as well as passwords in the DS configuration files. I will divide this DSIP into the following steps:
- [ ] 1. Introduce a cryptography plugin.
The Plugin includes an API module and implementation modules. The API module defines interfaces for various cryptographic algorithms, such as hash (digest) algorithms and asymmetric encryption algorithms.
- [ ] 2. Add an MD5 implementation for the digest algorithm interface.
- [ ] 3. Add an Sm3 implementation for the digest algorithm interface.
- [ ] 4. Add an Sm4 implementation for the symmetric encryption algorithm interface.
- [ ] 5. Add an AES implementation for the symmetric encryption algorithm interface.
- [ ] 6. Add bootsrap.yaml to allow users to configure the encryption algorithms they want to use.
- [ ] 7. Support the use of symmetric ciphertext in configuration files such as application.yaml, common.yaml, and environment variables, and use symmetric encryption algorithms to decrypt when retrieving these configurations.
- [ ] 8. The passwords in data source configurations should be modified to use ciphertext stored in the database, and decrypted upon retrieval.
- [ ] 9. Passwords for tasks that require configuration should be encrypted and then saved in the database.
- [ ] 10. Remove the DML statements for initializing users, and during the startup of Dolphin Scheduler, check if there is an initial user. If there is no initial user, initialize the user using the hash algorithm configured by the user, and modify the hash algorithm used for login.
### Compatibility, Deprecation, and Migration Plan
After user modify the login encryption algorithm, users will need to update the password ciphertext in the database.
### Test Plan
Step 2, 3, 4, and 5 require new unit tests to be added, and Step 6, 7, 8, 9, and 10 need to ensure that existing unit test cases pass.
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [DSIP] [Security] Support using encryption algorithms to encrypt the passwords entered by users in DS. [dolphinscheduler]
Posted by "SbloodyS (via GitHub)" <gi...@apache.org>.
SbloodyS commented on issue #16473:
URL: https://github.com/apache/dolphinscheduler/issues/16473#issuecomment-2292593238
> Some companies have mandatory requirements for the encryption algorithms used in software, and there may even be a
> need to use internal encryption algorithms specific to the company.
This sounds like an in-house customization requirement, not an open source project. So I'm -1 on this.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [I] [DSIP] [Security] Support using encryption algorithms to encrypt the passwords entered by users in DS. [dolphinscheduler]
Posted by "hdygxsj (via GitHub)" <gi...@apache.org>.
hdygxsj closed issue #16473: [DSIP] [Security] Support using encryption algorithms to encrypt the passwords entered by users in DS.
URL: https://github.com/apache/dolphinscheduler/issues/16473
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@dolphinscheduler.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org