You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@seata.apache.org by "YongGoose (via GitHub)" <gi...@apache.org> on 2025/03/31 10:36:42 UTC
[PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
YongGoose opened a new pull request, #7261:
URL: https://github.com/apache/incubator-seata/pull/7261
<!--
Licensed to the Apache Software Foundation (ASF) under one or more
contributor license agreements. See the NOTICE file distributed with
this work for additional information regarding copyright ownership.
The ASF licenses this file to You under the Apache License, Version 2.0
(the "License"); you may not use this file except in compliance with
the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<!-- Please make sure you have read and understood the contributing guidelines -->
- [x] I have registered the PR [changes](../changes).
### Ⅰ. Describe what this PR did
fix #6396
### Ⅱ. Does this pull request fix one issue?
<!-- If that, add "fixes #xxx" below in the next line, for example, fixes #97. -->
### Ⅲ. Why don't you add test cases (unit test/integration test)?
### Ⅳ. Describe how to verify it
### Ⅴ. Special notes for reviews
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2066578818
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
The modified result is now being logged as shown below!
```
22:56:58.549 INFO --- [ main] [y.CustomUserDetailsServiceImpl] [ init] [] : No password was configured. A random password has been generated for security purposes. You may either:
1. Use the auto-generated password: [424e287f]
2. Set a custom password in the configuration.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2868111979
> @funky-eyes @slievrly
>
> I don't think this should be merged right now. It could cause issues with login.
>
> I'll make the necessary changes and provide a more detailed explanation afterward.
During the login process, the password is compared using `PasswordEncoder` internally by the `AuthenticationManager`.
However, in the previous implementation, passwords were stored in plain text, which could have caused login failures.
This has now been corrected by updating the code to encrypt passwords using `PasswordEncoder`.
I ran the integration tests shown below, and since everything works as expected, I believe it's safe to proceed with the merge now.
`Random password test`
```java
@Test
public void loginSuccess_shouldReturnTokenAndAddToHeader(CapturedOutput output) throws Exception {
String logs = output.getOut();
Pattern pattern = Pattern.compile("Use the auto-generated password: \\[(.+?)\\]");
Matcher matcher = pattern.matcher(logs);
assertTrue(matcher.find(), "captured password not found in logs");
String extractedPassword = matcher.group(1);
User user = new User("seata", extractedPassword);
String userJson = objectMapper.writeValueAsString(user);
MvcResult result = mockMvc.perform(post("/api/v1/auth/login")
.contentType(MediaType.APPLICATION_JSON)
.content(userJson))
.andExpect(status().isOk())
.andExpect(jsonPath("$.success").value(true))
.andExpect(jsonPath("$.data").isNotEmpty())
.andExpect(header().exists(WebSecurityConfig.AUTHORIZATION_HEADER))
.andReturn();
String authHeader = result.getResponse().getHeader(WebSecurityConfig.AUTHORIZATION_HEADER);
assertNotNull(authHeader);
assert (authHeader.startsWith(WebSecurityConfig.TOKEN_PREFIX));
}
```
`Property test`
```java
@Test
public void loginSuccess_shouldReturnTokenAndAddToHeader() throws Exception {
User user = new User("seata", "foo");
String userJson = objectMapper.writeValueAsString(user);
MvcResult result = mockMvc.perform(post("/api/v1/auth/login")
.contentType(MediaType.APPLICATION_JSON)
.content(userJson))
.andExpect(status().isOk())
.andExpect(jsonPath("$.success").value(true))
.andExpect(jsonPath("$.data").isNotEmpty())
.andExpect(header().exists(WebSecurityConfig.AUTHORIZATION_HEADER))
.andReturn();
String authHeader = result.getResponse().getHeader(WebSecurityConfig.AUTHORIZATION_HEADER);
assertNotNull(authHeader);
assert (authHeader.startsWith(WebSecurityConfig.TOKEN_PREFIX));
}
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2050403227
##########
console/src/main/java/org/apache/seata/console/security/User.java:
##########
Review Comment:
> If there are no plans to change the user's `username` and `password`, it would be better to change the `User` class to a `record`.
>
@funky-eyes
What do you think about this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2765919208
@slievrly
Also, we need to consider how to handle this logic in the build workflow.
Currently, it expects username and password input, but input is not possible in a build workflow .
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2067718715
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
Well done
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "slievrly (via GitHub)" <gi...@apache.org>.
slievrly merged PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "codecov[bot] (via GitHub)" <gi...@apache.org>.
codecov[bot] commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2832693948
## [Codecov](https://app.codecov.io/gh/apache/incubator-seata/pull/7261?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) Report
All modified and coverable lines are covered by tests :white_check_mark:
> Project coverage is 54.27%. Comparing base [(`d3a7034`)](https://app.codecov.io/gh/apache/incubator-seata/commit/d3a7034f9aef2632cca574d462c945cd7b19a16a?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache) to head [(`2c4066c`)](https://app.codecov.io/gh/apache/incubator-seata/commit/2c4066c8b53e34f860539104c48c5aeed36fe583?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 2.x #7261 +/- ##
============================================
+ Coverage 54.24% 54.27% +0.03%
- Complexity 7264 7268 +4
============================================
Files 1178 1178
Lines 41965 41965
Branches 4924 4924
============================================
+ Hits 22764 22777 +13
+ Misses 17050 17036 -14
- Partials 2151 2152 +1
```
[see 2 files with indirect coverage changes](https://app.codecov.io/gh/apache/incubator-seata/pull/7261/indirect-changes?src=pr&el=tree-more&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
[](https://app.codecov.io/gh/apache/incubator-seata/pull/7261?src=pr&el=tree&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
</details>
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests, report on failures, and find test suite problems.
- :package: [JS Bundle Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "funky-eyes (via GitHub)" <gi...@apache.org>.
funky-eyes commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2065220619
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
Requiring users to read credentials (username and password) directly from environment variables would impose significant changes to their workflow and create a poor user experience. Instead, we can default to a predefined username (e.g., seata) and remove any default password. If no password is configured, the system will automatically generate a random password, log it for user reference, and notify them:
"No password was configured. A random password has been generated for security purposes. You may either:
1. Use the auto-generated password (see logs for details), or
2. Set a custom password in the configuration."
This approach ensures backward compatibility while guiding users toward secure practices.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2868120800
Since an integration test for login has been added, I believe it's okay to resume work on the issue below.
What do you think?
- #7158
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2050403227
##########
console/src/main/java/org/apache/seata/console/security/User.java:
##########
Review Comment:
> If there are no plans to change the user's `username` and `password`, it would be better to change the `User` class to a `record`.
>
@funky-eyes
What do you think about this issue?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2065303418
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
> Requiring users to read credentials (username and password) directly from environment variables would impose significant changes to their workflow and create a poor user experience. Instead, we can default to a predefined username (e.g., seata) and remove any default password. If no password is configured, the system will automatically generate a random password, log it for user reference, and notify them:
>
> "No password was configured. A random password has been generated for security purposes. You may either:
>
> 1. Use the auto-generated password (see logs for details), or
> 2. Set a custom password in the configuration."
>
> This approach ensures backward compatibility while guiding users toward secure practices.
Thank you for your comment!
As you pointed out, suddenly requiring users to provide credentials would lead to a poor user experience.
Following your suggestion, I will implement it so that if no password is set in the `YAML` configuration file, the system will generate a random password, log it, and notify the user accordingly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2829265382
> @slievrly
>
> Also, we need to consider how to handle this logic in the build workflow. Currently, it expects username and password input, but input is not possible in a build workflow.
>
> That's why the workflow below does not terminate. https://github.com/apache/incubator-seata/actions/runs/14169655810/job/39690431239?pr=7261
I resolved the problem in https://github.com/apache/incubator-seata/pull/7261/commits/78dd208a0d3061743a1e8a67b70fab0cb24e1aa3 by adding environment variables during the CI stage.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2065303418
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
> Requiring users to read credentials (username and password) directly from environment variables would impose significant changes to their workflow and create a poor user experience. Instead, we can default to a predefined username (e.g., seata) and remove any default password. If no password is configured, the system will automatically generate a random password, log it for user reference, and notify them:
>
> "No password was configured. A random password has been generated for security purposes. You may either:
>
> 1. Use the auto-generated password (see logs for details), or
> 2. Set a custom password in the configuration."
>
> This approach ensures backward compatibility while guiding users toward secure practices.
Thank you for your comment!
As you pointed out, suddenly requiring users to provide credentials would lead to a poor user experience.
Following your suggestion, I will implement it so that if no password is set in the `YAML` configuration file, the system will generate a random password, log it, and provide guidance to the user.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2840444238
> The problem currently occurs only with JDK 17, and I'm in the process of analyzing it.
>
> ```
> Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.apache.catalina.startup.Tomcat
> Caused by: java.lang.ExceptionInInitializerError
> ```
>
> The most likely cause at this point appears to be a compatibility issue between `JDK 17` and `Tomcat version 9.0.99`. If this turns out to be the case, we plan to upgrade Tomcat to version `9.1.00` with separate PR.
>
> * https://bz.apache.org/bugzilla/show_bug.cgi?id=69576
See https://github.com/apache/incubator-seata/pull/7329
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2814948109
@slievrly
Can you give some feedback on this PR? 🤔
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2839217119
The problem currently occurs only with JDK 17, and I'm in the process of analyzing it.
```
Caused by: java.lang.NoClassDefFoundError: Could not initialize class org.apache.catalina.startup.Tomcat
Caused by: java.lang.ExceptionInInitializerError
```
The most likely cause at this point appears to be a compatibility issue between `JDK 17` and `Tomcat version 9.0.99`.
If this turns out to be the case, we plan to upgrade Tomcat to version `9.1.00`.
- https://bz.apache.org/bugzilla/show_bug.cgi?id=69576
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#issuecomment-2868091394
@funky-eyes @slievrly
I don't think this should be merged right now.
It could cause issues with login.
I'll make the necessary changes and provide a more detailed explanation afterward.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] Feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2020808689
##########
console/src/main/java/org/apache/seata/console/security/User.java:
##########
Review Comment:
If there are no plans to change the user's `username` and `password`, it would be better to change the `User` class to a `record`.
What do you think? @slievrly
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org
Re: [PR] feature: enforce account initialization and disable default credentials [incubator-seata]
Posted by "YongGoose (via GitHub)" <gi...@apache.org>.
YongGoose commented on code in PR #7261:
URL: https://github.com/apache/incubator-seata/pull/7261#discussion_r2066558544
##########
console/src/main/java/org/apache/seata/console/security/CustomUserDetailsServiceImpl.java:
##########
@@ -32,23 +34,47 @@
@Service
public class CustomUserDetailsServiceImpl implements UserDetailsService {
- @Value("${console.user.username}")
- private String username;
-
- @Value("${console.user.password}")
- private String password;
-
+ private Console console;
private User user;
/**
* Init.
*/
@PostConstruct
- public void init() {
- // TODO: get userInfo by db
- user = new User();
- user.setUsername(username);
- user.setPassword(new BCryptPasswordEncoder().encode(password));
+ public void init() throws IOException {
+ String envUsername = System.getenv("SEATA_CONSOLE_USERNAME");
Review Comment:
Done in https://github.com/apache/incubator-seata/pull/7261/commits/a02be9533a983c03c212e1ea1b865f19a85385b1 !
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@seata.apache.org
For additional commands, e-mail: notifications-help@seata.apache.org