[jira] [Created] (SOLR-12778) Support encrypted password for ZK cred/ACL providers

["Jan Høydahl (JIRA)" <ji...@apache.org>]

Jan Høydahl created SOLR-12778:
----------------------------------

             Summary: Support encrypted password for ZK cred/ACL providers
                 Key: SOLR-12778
                 URL: https://issues.apache.org/jira/browse/SOLR-12778
             Project: Solr
          Issue Type: New Feature
      Security Level: Public (Default Security Level. Issues are Public)
          Components: SolrCloud
            Reporter: Jan Høydahl


The {{VMParamsSingleSetCredentialsDigestZkCredentialsProvider}} takes a {{zkDigestPassword}} in as a plain-text JVM param, and the {{VMParamsAllAndReadonlyDigestZkACLProvider}} takes both {{zkDigestPassword}} and {{zkDigestReadonlyPassword}}.

Propose to give an option to encrypt these password using the same mechanism as DIH does:
 # Add a new VM param "zkDigestPasswordEncryptionKeyFile" which is a path to a file holding the encryption key
 # Store an encryption key in above mentioned file and restrict access to this file so only Solr user can read it.
 # Encrypt the ZK passwords using the encryption key and provide the encrypted password in place of the plaintext one

We could also create a utility command that takes the magic out of encrypting the pw:
{noformat}
bin/solr util encrypt [-keyfile <file>] <string>{noformat}
 



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@lucene.apache.org
For additional commands, e-mail: dev-help@lucene.apache.org