This is an automated email from the ASF dual-hosted git repository.
JackieTien97 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/iotdb.git
The following commit(s) were added to refs/heads/master by this push:
new e616dc50c1f Add credential strength baseline for test-created users in
IT guidance (#19045)
e616dc50c1f is described below
commit e616dc50c1f4f3a0112557485f7664f2aaa82d10
Author: Jackie Tien <[email protected]>
AuthorDate: Thu Oct 29 11:35:40 2026 +0800
Add credential strength baseline for test-created users in IT guidance
(#19045)
---
integration-test/AGENTS.md | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/integration-test/AGENTS.md b/integration-test/AGENTS.md
index e21be94fbfb..25bb23fe836 100644
--- a/integration-test/AGENTS.md
+++ b/integration-test/AGENTS.md
@@ -36,6 +36,15 @@ These instructions apply to `integration-test/` and
supplement the repository-le
while a manually constructed discovery client silently uses different ones.
- Explicit credentials are appropriate for users created by the test and for
authentication or
invalid-password scenarios. Make that intent clear, and clean up users
created by the test.
+- When a test creates users or roles with explicit credentials, make each
password 12-32
+ characters long with no spaces, drawn from the supported credential charset
(letters,
+ digits, `_ - ! @ # $ % ^ & * ( ) + =`), containing at least one lowercase
letter, one
+ uppercase letter, one digit, and one special character, and different from
the username;
+ usernames use the same charset and a 4-32 character length (for example
`newuser` with
+ `IoTDB!Test2024`). Trivial placeholders such as `123456` or `password` pass
on a default
+ local cluster yet are exactly what stricter password policies reject, and
they encourage
+ weak secrets to spread into real configurations through copied test code.
Reserve weak or
+ illegal credentials for scenarios that deliberately test them.
- Obtain node addresses and allocated ports from the test environment or node
wrappers. Configure
required consensus protocols, replication factors, and other non-default
settings before
initializing the cluster.
