This is an automated email from the ASF dual-hosted git repository. ilgrosso pushed a commit to branch 4_0_X in repository https://gitbox.apache.org/repos/asf/syncope.git
commit baae60187a8003c46d2ccbaf4e4007cc9edafdc2 Author: Francesco Chicchiriccò <[email protected]> AuthorDate: Thu Sep 10 14:00:01 2026 +0200 Parameterize default credentials --- .../persistence/jpa/PersistenceTestContext.java | 3 ++- .../persistence/neo4j/PersistenceTestContext.java | 3 ++- core/spring/pom.xml | 4 ++-- .../spring/security/DefaultCredentialChecker.java | 27 +++++++++++----------- .../core/spring/security/SecurityContext.java | 2 +- .../META-INF/default-credentials.properties | 20 ++++++++++++++++ .../core/spring/SpringTestConfiguration.java | 2 +- .../core/spring/security/DefaultEncryptorTest.java | 3 ++- .../org/apache/syncope/fit/AbstractITCase.java | 11 ++++++--- 9 files changed, 51 insertions(+), 24 deletions(-) diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java index 42b530d87d..b12773de89 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.persistence.jpa; import jakarta.persistence.EntityManagerFactory; +import java.io.IOException; import javax.sql.DataSource; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; @@ -116,7 +117,7 @@ public class PersistenceTestContext { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); diff --git a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java index dd26b09595..75f7ddd762 100644 --- a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java +++ b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.persistence.neo4j; +import java.io.IOException; import javax.cache.CacheManager; import javax.cache.Caching; import org.apache.commons.lang3.StringUtils; @@ -108,7 +109,7 @@ public class PersistenceTestContext { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); diff --git a/core/spring/pom.xml b/core/spring/pom.xml index 7359d7f12b..b65f773e73 100644 --- a/core/spring/pom.xml +++ b/core/spring/pom.xml @@ -151,14 +151,14 @@ under the License. <directory>src/main/resources</directory> <filtering>true</filtering> <includes> - <include>**/security.properties</include> + <include>**/default-credentials.properties</include> </includes> </resource> <resource> <directory>src/main/resources</directory> <filtering>false</filtering> <excludes> - <exclude>**/security.properties</exclude> + <exclude>**/default-credentials.properties</exclude> </excludes> </resource> </resources> diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java index 84e4732a59..e0a8bc3e84 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java @@ -18,6 +18,9 @@ */ package org.apache.syncope.core.spring.security; +import java.io.IOException; +import java.io.InputStream; +import java.util.Properties; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -32,27 +35,18 @@ public class DefaultCredentialChecker { "The default AES key property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_AES_KEY = "1abcdefghilmnopqrstuvz2!"; - private static final String DEFAULT_JWS_KEY_ERROR_MESSAGE = "The default JWKS key property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_JWS_KEY = "ZW7pRixehFuNUtnY5Se47IemgMryTzazPPJ9CGX5LTCmsOJpOgHAQEuPQeV9A28f"; - private static final String DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE = "The default adminPassword property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_ADMIN_PASSWORD = - "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464"; - private static final String DEFAULT_ANON_KEY_ERROR_MESSAGE = "The default anonymousKey property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_ANON_KEY = "anonymousKey"; - private final boolean defaultAesKeyInUse; private final boolean defaultJwsKeyInUse; @@ -68,12 +62,17 @@ public class DefaultCredentialChecker { final String jwsKey, final String adminPassword, final String anonymousKey, - final boolean productionMode) { + final boolean productionMode) throws IOException { + + try (InputStream in = getClass().getResourceAsStream("/META-INF/default-credentials.properties")) { + Properties defaultCredentials = new Properties(); + defaultCredentials.load(in); + defaultAesKeyInUse = defaultCredentials.getProperty("default.aesSecretKey").equals(aesKey); + defaultJwsKeyInUse = defaultCredentials.getProperty("default.jwsKey").equals(jwsKey); + defaultAdminPasswordInUse = defaultCredentials.getProperty("default.adminPassword").equals(adminPassword); + defaultAnonymousKeyInUse = defaultCredentials.getProperty("default.anonymousKey").equals(anonymousKey); + } - defaultAesKeyInUse = DEFAULT_AES_KEY.equals(aesKey); - defaultJwsKeyInUse = DEFAULT_JWS_KEY.equals(jwsKey); - defaultAdminPasswordInUse = DEFAULT_ADMIN_PASSWORD.equals(adminPassword); - defaultAnonymousKeyInUse = DEFAULT_ANON_KEY.equals(anonymousKey); this.productionMode = productionMode; } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java index 5b7d10e7ba..6d0bd9c5b9 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java @@ -113,7 +113,7 @@ public class SecurityContext { @Bean public DefaultCredentialChecker credentialChecker( final SecurityProperties props, - final JWSAlgorithm jwsAlgorithm) { + final JWSAlgorithm jwsAlgorithm) throws IOException { return new DefaultCredentialChecker( props.getAesSecretKey(), diff --git a/core/spring/src/main/resources/META-INF/default-credentials.properties b/core/spring/src/main/resources/META-INF/default-credentials.properties new file mode 100644 index 0000000000..8c96bdc4b6 --- /dev/null +++ b/core/spring/src/main/resources/META-INF/default-credentials.properties @@ -0,0 +1,20 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +default.aesSecretKey=${secretKey} +default.jwsKey=${jwsKey} +default.adminPassword=${adminPassword} +default.anonymousKey=${anonymousKey} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java index 7d6d2d2757..11094b8ee3 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java @@ -47,7 +47,7 @@ public class SpringTestConfiguration { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(AES_SECRET_KEY); return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java index 1ff092f3ca..07286aea44 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java @@ -24,6 +24,7 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.assertTrue; +import java.io.IOException; import java.security.InvalidKeyException; import org.apache.syncope.common.lib.types.CipherAlgorithm; import org.apache.syncope.core.persistence.api.ApplicationContextProvider; @@ -39,7 +40,7 @@ public class DefaultEncryptorTest { private static Encryptor ENCRYPTOR; @BeforeAll - public static void setUp() { + public static void setUp() throws IOException { SecurityProperties props = new SecurityProperties(); props.setAesSecretKey(SpringTestConfiguration.AES_SECRET_KEY); ApplicationContextProvider.getBeanFactory().registerSingleton("securityProperties", props); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java index 56544e1691..e322d60214 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java @@ -21,6 +21,7 @@ package org.apache.syncope.fit; import static org.awaitility.Awaitility.await; import static org.junit.jupiter.api.Assertions.assertEquals; import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.fail; import com.fasterxml.jackson.databind.JsonNode; import com.fasterxml.jackson.databind.json.JsonMapper; @@ -1163,13 +1164,17 @@ public abstract class AbstractITCase { @Autowired protected DataSource testDataSource; - protected final EncryptorManager encryptorManager; + protected EncryptorManager encryptorManager; protected AbstractITCase() { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); - encryptorManager = new DefaultEncryptorManager( - new DefaultCredentialChecker("", "", "", "", false), securityProperties); + try { + encryptorManager = new DefaultEncryptorManager( + new DefaultCredentialChecker("", "", "", "", false), securityProperties); + } catch (IOException e) { + fail(e.getMessage(), e); + } } }
