You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@oozie.apache.org by "Robert Kanter (JIRA)" <ji...@apache.org> on 2013/12/20 22:46:09 UTC

[jira] [Created] (OOZIE-1651) Oozie should mask the signature secret in the configuration output

Robert Kanter created OOZIE-1651:
------------------------------------

             Summary: Oozie should mask the signature secret in the configuration output
                 Key: OOZIE-1651
                 URL: https://issues.apache.org/jira/browse/OOZIE-1651
             Project: Oozie
          Issue Type: Bug
          Components: security
    Affects Versions: 4.0.0, 3.3.2
            Reporter: Robert Kanter
            Assignee: Robert Kanter
            Priority: Critical


The value of {{oozie.authentication.signature.secret}} is the secret that's used to sign the cookies/tokens crated by Oozie for authentication after Kerberos.  If a malicious user were to find out this secret, they could forge counterfeit cookies/tokens as any user with any expiration date.  

Oozie exposed the configuration properties via its REST API.  It currently only masks any properties that end with ".password" (i.e. {{oozie.service.JPAService.jdbc.password}}).  We should expand this to also mask the signature secret.  

In fact, it would be useful to generalize this ability to add a property that masks something the user can configure.



--
This message was sent by Atlassian JIRA
(v6.1.4#6159)