You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@inlong.apache.org by "spiritxishi (via GitHub)" <gi...@apache.org> on 2026/07/07 06:46:25 UTC
[PR] [INLONG-12150][Improve][Manager][Dashboard] Enforce password change o… [inlong]
spiritxishi opened a new pull request, #12154:
URL: https://github.com/apache/inlong/pull/12154
[INLONG-12150][Improve][Manager][Dashboard] Enforce password change on first login for default admin account (#12150)
Fixes #12150
### Motivation
The default admin account (admin/inlong) has no mechanism prompting credential rotation after deployment, leaving a hard-coded password accessible to anyone who reaches the login page. This PR enforces a mandatory password change on first login.
### Modifications
**Manager**: New LoginResponse DTO with mustChangePassword flag; UserService.isDefaultUsernameAndPassword() checks against DEFAULT_USER + SHA-256("inlong"); AnnoController.login() returns the new DTO.
**Dashboard**: New ForcePasswordChangeModal.tsx (non-closable, forces logout on success); Login/index.tsx reads mustChangePassword and sets sessionStorage flags; Layout renders the modal.
**Tests**: AnnoControllerTest verifies mustChangePassword=true for default admin login.
### Verifying this change
*(Please pick either of the following options)*
- [ ] This change is a trivial rework/code cleanup without any test coverage.
- [ ] This change is already covered by existing tests, such as:
AnnoControllerTest.testLoginReturnsMustChangePasswordForDefaultAdmin — verifies the backend returns mustChangePassword=true.
- [ ] This change added tests and can be verified as follows:
### Documentation
- Does this pull request introduce a new feature? (yes)
- If yes, how is the feature documented? ( Issue#10150 + JavaDocs + TSDoc on LoginResponse, UserService.isDefaultUsernameAndPassword, and ForcePasswordChangeModal.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [INLONG-12150][Improve][Manager][Dashboard] Enforce password change on first login for default admin account [inlong]
Posted by "luchunliang (via GitHub)" <gi...@apache.org>.
luchunliang commented on code in PR #12154:
URL: https://github.com/apache/inlong/pull/12154#discussion_r3534803218
##########
inlong-manager/manager-service/src/main/java/org/apache/inlong/manager/service/user/UserServiceImpl.java:
##########
@@ -353,6 +355,24 @@ public void login(UserLoginRequest req) {
loginLockStatusMap.put(username, userLoginLockStatus);
}
+ @Override
+ public boolean isDefaultUsernameAndPassword(String username) {
+ if (StringUtils.isBlank(username) || !DEFAULT_USER.equals(username)) {
+ return false;
+ }
+ try {
+ UserEntity entity = userMapper.selectByName(username);
Review Comment:
Querying the DB on every login seems prone to brute-force attacks — maybe add a short-TTL cache
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [INLONG-12150][Improve][Manager][Dashboard] Enforce password change on first login for default admin account [inlong]
Posted by "spiritxishi (via GitHub)" <gi...@apache.org>.
spiritxishi closed pull request #12154: [INLONG-12150][Improve][Manager][Dashboard] Enforce password change on first login for default admin account
URL: https://github.com/apache/inlong/pull/12154
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@inlong.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org