You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@cloudstack.apache.org by Tejas Gadaria <re...@gmail.com> on 2014/04/15 11:02:19 UTC
login API with MD5 is not working
Hi,
I am trying to login in to CS 4.3 though login API.
I am passing MD5 hash (1st) in password that works fine with CS 4.0.2 but
same doesn't works well with CS 4.3. Then I try to pass password in plain
text ( 2nd) & it worked, Is this a bug?
Both APIs are given below,
1)
http://10.129.151.55:8080/client/api?&command=login&username=admin&password=5f4dcc3b5aa765d61d8327deb882cf99
2)
http://10.129.151.55:8080/client/api?&command=login&username=admin&password=password
Regards,
Tejas
Re: login API with MD5 is not working
Posted by Nate Gordon <na...@appcore.com>.
CloudStack changed password encoding in 4.2 (I believe, but I seem to
remember, but can't find documentation that it changed in 4.1) such that it
no longer assumes that passwords are MD5s coming in. It instead expects
that passwords are passed as plain text and are encoded by CS internally
according to how it is configured to store passwords. Documentation is at:
http://cloudstack.apache.org/docs/en-US/Apache_CloudStack/4.2.0/html/Installation_Guide/management-server-install-flow.html#password-storage-engine
This threw me off as well and applies to both logins and user/account
create.
Thanks,
-Nate
On Tue, Apr 15, 2014 at 3:02 AM, Tejas Gadaria <re...@gmail.com>wrote:
> Hi,
>
> I am trying to login in to CS 4.3 though login API.
>
> I am passing MD5 hash (1st) in password that works fine with CS 4.0.2 but
> same doesn't works well with CS 4.3. Then I try to pass password in plain
> text ( 2nd) & it worked, Is this a bug?
>
> Both APIs are given below,
>
>
> 1)
>
> http://10.129.151.55:8080/client/api?&command=login&username=admin&password=5f4dcc3b5aa765d61d8327deb882cf99
>
>
> 2)
>
> http://10.129.151.55:8080/client/api?&command=login&username=admin&password=password
>
> Regards,
> Tejas
>
--
*Nate Gordon*Director of Technology | Appcore - the business of cloud
computing®
Office +1.800.735.7104 | Direct +1.515.612.7787
nate.gordon@appcore.com | www.appcore.com
----------------------------------------------------------------------
The information in this message is intended for the named recipients only.
It may contain information that is privileged, confidential or otherwise
protected from disclosure. If you are not the intended recipient, you are
hereby notified that any disclosure, copying, distribution, or the taking
of any action in reliance on the contents of this message is strictly
prohibited. If you have received this e-mail in error, do not print it or
disseminate it or its contents. In such event, please notify the sender by
return e-mail and delete the e-mail file immediately thereafter. Thank you.
Re: login API with MD5 is not working
Posted by Tejas Gadaria <re...@gmail.com>.
Thanks Demetrius!
On Thu, Apr 17, 2014 at 10:24 PM, Demetrius Tsitrelis <
Demetrius.Tsitrelis@citrix.com> wrote:
> Some authenticators such as LDAP need clear text passwords.
>
> -----Original Message-----
> From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> Sent: Wednesday, April 16, 2014 8:36 PM
> To: dev@cloudstack.apache.org
> Subject: Re: login API with MD5 is not working
>
> Hi Demetrius,
>
> Thanks for explanation, I will try with https now.
> Just for information, why did they change this from MD5 to plain text?
>
> Regards,
> Tejas
>
>
> On Thu, Apr 17, 2014 at 1:03 AM, Demetrius Tsitrelis <
> Demetrius.Tsitrelis@citrix.com> wrote:
>
> > There is already an open bug
> > (https://issues.apache.org/jira/browse/CLOUDSTACK-6311). Essentially
> > the same wording for the password parameter should be used in login,
> > CreateUser, and UpdateUser: the password should be sent as clear text.
> >
> > -----Original Message-----
> > From: Sebastien Goasguen [mailto:runseb@gmail.com]
> > Sent: Wednesday, April 16, 2014 12:16 PM
> > To: dev@cloudstack.apache.org
> > Subject: Re: login API with MD5 is not working
> >
> >
> > On Apr 16, 2014, at 12:56 PM, Demetrius Tsitrelis
> > <De...@citrix.com> wrote:
> >
> > > One problem is that the API documentation
> > > (https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login
> > > .h
> > > tml) still says that the password should be hashed. The docs are
> > > out of date; send the password in plain text.
> >
> > Demetrius, can you give me the correct description for the apidoc ?
> > I can make that change.
> >
> > >
> > > And - think about security. DON'T use HTTP GET or the query
> > > parameters you send will be saved in the caches of all intermediate
> > > servers. Also DO use HTTPS.
> > >
> > > -----Original Message-----
> > > From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> > > Sent: Tuesday, April 15, 2014 2:02 AM
> > > To: dev@cloudstack.apache.org
> > > Subject: login API with MD5 is not working
> > >
> > > Hi,
> > >
> > > I am trying to login in to CS 4.3 though login API.
> > >
> > > I am passing MD5 hash (1st) in password that works fine with CS
> > > 4.0.2 but same doesn't works well with CS 4.3. Then I try to pass
> > > password in plain text (
> > > 2nd) & it worked, Is this a bug?
> > >
> > > Both APIs are given below,
> > >
> > >
> > > 1)
> > > http://10.129.151.55:8080/client/api?&command=login&username=admin&p
> > > as
> > > sword=5f4dcc3b5aa765d61d8327deb882cf99
> > >
> > >
> > > 2)
> > > http://10.129.151.55:8080/client/api?&command=login&username=admin&p
> > > as
> > > sword=password
> > >
> > > Regards,
> > > Tejas
> >
> >
>
RE: login API with MD5 is not working
Posted by Demetrius Tsitrelis <De...@citrix.com>.
Some authenticators such as LDAP need clear text passwords.
-----Original Message-----
From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
Sent: Wednesday, April 16, 2014 8:36 PM
To: dev@cloudstack.apache.org
Subject: Re: login API with MD5 is not working
Hi Demetrius,
Thanks for explanation, I will try with https now.
Just for information, why did they change this from MD5 to plain text?
Regards,
Tejas
On Thu, Apr 17, 2014 at 1:03 AM, Demetrius Tsitrelis < Demetrius.Tsitrelis@citrix.com> wrote:
> There is already an open bug
> (https://issues.apache.org/jira/browse/CLOUDSTACK-6311). Essentially
> the same wording for the password parameter should be used in login,
> CreateUser, and UpdateUser: the password should be sent as clear text.
>
> -----Original Message-----
> From: Sebastien Goasguen [mailto:runseb@gmail.com]
> Sent: Wednesday, April 16, 2014 12:16 PM
> To: dev@cloudstack.apache.org
> Subject: Re: login API with MD5 is not working
>
>
> On Apr 16, 2014, at 12:56 PM, Demetrius Tsitrelis
> <De...@citrix.com> wrote:
>
> > One problem is that the API documentation
> > (https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login
> > .h
> > tml) still says that the password should be hashed. The docs are
> > out of date; send the password in plain text.
>
> Demetrius, can you give me the correct description for the apidoc ?
> I can make that change.
>
> >
> > And - think about security. DON'T use HTTP GET or the query
> > parameters you send will be saved in the caches of all intermediate
> > servers. Also DO use HTTPS.
> >
> > -----Original Message-----
> > From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> > Sent: Tuesday, April 15, 2014 2:02 AM
> > To: dev@cloudstack.apache.org
> > Subject: login API with MD5 is not working
> >
> > Hi,
> >
> > I am trying to login in to CS 4.3 though login API.
> >
> > I am passing MD5 hash (1st) in password that works fine with CS
> > 4.0.2 but same doesn't works well with CS 4.3. Then I try to pass
> > password in plain text (
> > 2nd) & it worked, Is this a bug?
> >
> > Both APIs are given below,
> >
> >
> > 1)
> > http://10.129.151.55:8080/client/api?&command=login&username=admin&p
> > as
> > sword=5f4dcc3b5aa765d61d8327deb882cf99
> >
> >
> > 2)
> > http://10.129.151.55:8080/client/api?&command=login&username=admin&p
> > as
> > sword=password
> >
> > Regards,
> > Tejas
>
>
Re: login API with MD5 is not working
Posted by Tejas Gadaria <re...@gmail.com>.
Hi Demetrius,
Thanks for explanation, I will try with https now.
Just for information, why did they change this from MD5 to plain text?
Regards,
Tejas
On Thu, Apr 17, 2014 at 1:03 AM, Demetrius Tsitrelis <
Demetrius.Tsitrelis@citrix.com> wrote:
> There is already an open bug
> (https://issues.apache.org/jira/browse/CLOUDSTACK-6311). Essentially the
> same wording for the password parameter should be used in login,
> CreateUser,
> and UpdateUser: the password should be sent as clear text.
>
> -----Original Message-----
> From: Sebastien Goasguen [mailto:runseb@gmail.com]
> Sent: Wednesday, April 16, 2014 12:16 PM
> To: dev@cloudstack.apache.org
> Subject: Re: login API with MD5 is not working
>
>
> On Apr 16, 2014, at 12:56 PM, Demetrius Tsitrelis
> <De...@citrix.com> wrote:
>
> > One problem is that the API documentation
> > (https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login.h
> > tml) still says that the password should be hashed. The docs are out
> > of date; send the password in plain text.
>
> Demetrius, can you give me the correct description for the apidoc ?
> I can make that change.
>
> >
> > And - think about security. DON'T use HTTP GET or the query
> > parameters you send will be saved in the caches of all intermediate
> > servers. Also DO use HTTPS.
> >
> > -----Original Message-----
> > From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> > Sent: Tuesday, April 15, 2014 2:02 AM
> > To: dev@cloudstack.apache.org
> > Subject: login API with MD5 is not working
> >
> > Hi,
> >
> > I am trying to login in to CS 4.3 though login API.
> >
> > I am passing MD5 hash (1st) in password that works fine with CS 4.0.2
> > but same doesn't works well with CS 4.3. Then I try to pass password
> > in plain text (
> > 2nd) & it worked, Is this a bug?
> >
> > Both APIs are given below,
> >
> >
> > 1)
> > http://10.129.151.55:8080/client/api?&command=login&username=admin&pas
> > sword=5f4dcc3b5aa765d61d8327deb882cf99
> >
> >
> > 2)
> > http://10.129.151.55:8080/client/api?&command=login&username=admin&pas
> > sword=password
> >
> > Regards,
> > Tejas
>
>
RE: login API with MD5 is not working
Posted by Demetrius Tsitrelis <De...@citrix.com>.
There is already an open bug
(https://issues.apache.org/jira/browse/CLOUDSTACK-6311). Essentially the
same wording for the password parameter should be used in login, CreateUser,
and UpdateUser: the password should be sent as clear text.
-----Original Message-----
From: Sebastien Goasguen [mailto:runseb@gmail.com]
Sent: Wednesday, April 16, 2014 12:16 PM
To: dev@cloudstack.apache.org
Subject: Re: login API with MD5 is not working
On Apr 16, 2014, at 12:56 PM, Demetrius Tsitrelis
<De...@citrix.com> wrote:
> One problem is that the API documentation
> (https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login.h
> tml) still says that the password should be hashed. The docs are out
> of date; send the password in plain text.
Demetrius, can you give me the correct description for the apidoc ?
I can make that change.
>
> And - think about security. DON'T use HTTP GET or the query
> parameters you send will be saved in the caches of all intermediate
> servers. Also DO use HTTPS.
>
> -----Original Message-----
> From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> Sent: Tuesday, April 15, 2014 2:02 AM
> To: dev@cloudstack.apache.org
> Subject: login API with MD5 is not working
>
> Hi,
>
> I am trying to login in to CS 4.3 though login API.
>
> I am passing MD5 hash (1st) in password that works fine with CS 4.0.2
> but same doesn't works well with CS 4.3. Then I try to pass password
> in plain text (
> 2nd) & it worked, Is this a bug?
>
> Both APIs are given below,
>
>
> 1)
> http://10.129.151.55:8080/client/api?&command=login&username=admin&pas
> sword=5f4dcc3b5aa765d61d8327deb882cf99
>
>
> 2)
> http://10.129.151.55:8080/client/api?&command=login&username=admin&pas
> sword=password
>
> Regards,
> Tejas
Re: login API with MD5 is not working
Posted by Sebastien Goasguen <ru...@gmail.com>.
On Apr 16, 2014, at 12:56 PM, Demetrius Tsitrelis <De...@citrix.com> wrote:
> One problem is that the API documentation
> (https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login.html)
> still says that the password should be hashed. The docs are out of date; send
> the password in plain text.
Demetrius, can you give me the correct description for the apidoc ?
I can make that change.
>
> And - think about security. DON'T use HTTP GET or the query parameters you
> send will be saved in the caches of all intermediate servers. Also DO use
> HTTPS.
>
> -----Original Message-----
> From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
> Sent: Tuesday, April 15, 2014 2:02 AM
> To: dev@cloudstack.apache.org
> Subject: login API with MD5 is not working
>
> Hi,
>
> I am trying to login in to CS 4.3 though login API.
>
> I am passing MD5 hash (1st) in password that works fine with CS 4.0.2 but same
> doesn't works well with CS 4.3. Then I try to pass password in plain text (
> 2nd) & it worked, Is this a bug?
>
> Both APIs are given below,
>
>
> 1)
> http://10.129.151.55:8080/client/api?&command=login&username=admin&password=5f4dcc3b5aa765d61d8327deb882cf99
>
>
> 2)
> http://10.129.151.55:8080/client/api?&command=login&username=admin&password=password
>
> Regards,
> Tejas
RE: login API with MD5 is not working
Posted by Demetrius Tsitrelis <De...@citrix.com>.
One problem is that the API documentation
(https://cloudstack.apache.org/docs/api/apidocs-4.3/root_admin/login.html)
still says that the password should be hashed. The docs are out of date; send
the password in plain text.
And - think about security. DON'T use HTTP GET or the query parameters you
send will be saved in the caches of all intermediate servers. Also DO use
HTTPS.
-----Original Message-----
From: Tejas Gadaria [mailto:refond.gmrt@gmail.com]
Sent: Tuesday, April 15, 2014 2:02 AM
To: dev@cloudstack.apache.org
Subject: login API with MD5 is not working
Hi,
I am trying to login in to CS 4.3 though login API.
I am passing MD5 hash (1st) in password that works fine with CS 4.0.2 but same
doesn't works well with CS 4.3. Then I try to pass password in plain text (
2nd) & it worked, Is this a bug?
Both APIs are given below,
1)
http://10.129.151.55:8080/client/api?&command=login&username=admin&password=5f4dcc3b5aa765d61d8327deb882cf99
2)
http://10.129.151.55:8080/client/api?&command=login&username=admin&password=password
Regards,
Tejas