You are viewing a plain text version of this content. The canonical link for it is here.
Posted to common-issues@hadoop.apache.org by "Li Lu (JIRA)" <ji...@apache.org> on 2015/03/27 00:03:52 UTC
[jira] [Updated] (HADOOP-11748) Secrets for auth cookies can be
specified in clear text
[ https://issues.apache.org/jira/browse/HADOOP-11748?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Li Lu updated HADOOP-11748:
---------------------------
Attachment: HADOOP-11748-032615-poc.patch
Did some work to change the {{StringSecretProvider}} class to be test only. Most work done but TestAuthenticationFilter is failing because we're changing the default filters. In a comprehensive fix we need to change the mockito settings in TestAuthenticationFilter to create {{StringSecretProvider}}s in {{config}} objects.
> Secrets for auth cookies can be specified in clear text
> -------------------------------------------------------
>
> Key: HADOOP-11748
> URL: https://issues.apache.org/jira/browse/HADOOP-11748
> Project: Hadoop Common
> Issue Type: Bug
> Reporter: Haohui Mai
> Assignee: Li Lu
> Priority: Critical
> Attachments: HADOOP-11748-032615-poc.patch
>
>
> Based on the discussion on HADOOP-10670, this jira proposes to remove {{StringSecretProvider}} as it opens up possibilities for misconfiguration and security vulnerabilities.
> {quote}
> My understanding is that the use case of inlining the secret is never supported. The property is used to pass the secret internally. The way it works before HADOOP-10868 is the following:
> * Users specify the initializer of the authentication filter in the configuration.
> * AuthenticationFilterInitializer reads the secret file. The server will not start if the secret file does not exists. The initializer will set the property if it read the file correctly.
> *There is no way to specify the secret in the configuration out-of-the-box – the secret is always overwritten by AuthenticationFilterInitializer.
> {quote}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)