This is an automated email from the ASF dual-hosted git repository. ilgrosso pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/syncope.git
commit 13df29e8415d00339a0c02cb470bf875b7c9f9a9 Author: Francesco Chicchiriccò <[email protected]> AuthorDate: Thu Sep 10 14:00:01 2026 +0200 Parameterize default credentials --- .../persistence/jpa/PersistenceTestContext.java | 3 ++- .../persistence/neo4j/PersistenceTestContext.java | 3 ++- core/spring/pom.xml | 4 ++-- .../spring/security/DefaultCredentialChecker.java | 27 +++++++++++----------- .../core/spring/security/SecurityContext.java | 2 +- .../META-INF/default-credentials.properties | 20 ++++++++++++++++ .../core/spring/SpringTestConfiguration.java | 2 +- .../core/spring/security/DefaultEncryptorTest.java | 3 ++- .../org/apache/syncope/fit/AbstractITCase.java | 10 +++++--- 9 files changed, 50 insertions(+), 24 deletions(-) diff --git a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java index 9f9aec48be..89753aef2f 100644 --- a/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java +++ b/core/persistence-jpa/src/test/java/org/apache/syncope/core/persistence/jpa/PersistenceTestContext.java @@ -19,6 +19,7 @@ package org.apache.syncope.core.persistence.jpa; import jakarta.persistence.EntityManagerFactory; +import java.io.IOException; import javax.sql.DataSource; import org.apache.commons.lang3.StringUtils; import org.apache.syncope.common.keymaster.client.api.ConfParamOps; @@ -118,7 +119,7 @@ public class PersistenceTestContext { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); diff --git a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java index dd26b09595..75f7ddd762 100644 --- a/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java +++ b/core/persistence-neo4j/src/test/java/org/apache/syncope/core/persistence/neo4j/PersistenceTestContext.java @@ -18,6 +18,7 @@ */ package org.apache.syncope.core.persistence.neo4j; +import java.io.IOException; import javax.cache.CacheManager; import javax.cache.Caching; import org.apache.commons.lang3.StringUtils; @@ -108,7 +109,7 @@ public class PersistenceTestContext { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); diff --git a/core/spring/pom.xml b/core/spring/pom.xml index 42c84cae8f..0af9c3ee2d 100644 --- a/core/spring/pom.xml +++ b/core/spring/pom.xml @@ -164,14 +164,14 @@ under the License. <directory>src/main/resources</directory> <filtering>true</filtering> <includes> - <include>**/security.properties</include> + <include>**/default-credentials.properties</include> </includes> </resource> <resource> <directory>src/main/resources</directory> <filtering>false</filtering> <excludes> - <exclude>**/security.properties</exclude> + <exclude>**/default-credentials.properties</exclude> </excludes> </resource> </resources> diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java index 84e4732a59..e0a8bc3e84 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/DefaultCredentialChecker.java @@ -18,6 +18,9 @@ */ package org.apache.syncope.core.spring.security; +import java.io.IOException; +import java.io.InputStream; +import java.util.Properties; import org.slf4j.Logger; import org.slf4j.LoggerFactory; @@ -32,27 +35,18 @@ public class DefaultCredentialChecker { "The default AES key property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_AES_KEY = "1abcdefghilmnopqrstuvz2!"; - private static final String DEFAULT_JWS_KEY_ERROR_MESSAGE = "The default JWKS key property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_JWS_KEY = "ZW7pRixehFuNUtnY5Se47IemgMryTzazPPJ9CGX5LTCmsOJpOgHAQEuPQeV9A28f"; - private static final String DEFAULT_ADMIN_PASSWORD_ERROR_MESSAGE = "The default adminPassword property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_ADMIN_PASSWORD = - "DE088591C00CC98B36F5ADAAF7DA2B004CF7F2FE7BBB45B766B6409876E2F3DB13C7905C6AA59464"; - private static final String DEFAULT_ANON_KEY_ERROR_MESSAGE = "The default anonymousKey property is being used. " + "This must be changed to avoid a security breach!"; - private static final String DEFAULT_ANON_KEY = "anonymousKey"; - private final boolean defaultAesKeyInUse; private final boolean defaultJwsKeyInUse; @@ -68,12 +62,17 @@ public class DefaultCredentialChecker { final String jwsKey, final String adminPassword, final String anonymousKey, - final boolean productionMode) { + final boolean productionMode) throws IOException { + + try (InputStream in = getClass().getResourceAsStream("/META-INF/default-credentials.properties")) { + Properties defaultCredentials = new Properties(); + defaultCredentials.load(in); + defaultAesKeyInUse = defaultCredentials.getProperty("default.aesSecretKey").equals(aesKey); + defaultJwsKeyInUse = defaultCredentials.getProperty("default.jwsKey").equals(jwsKey); + defaultAdminPasswordInUse = defaultCredentials.getProperty("default.adminPassword").equals(adminPassword); + defaultAnonymousKeyInUse = defaultCredentials.getProperty("default.anonymousKey").equals(anonymousKey); + } - defaultAesKeyInUse = DEFAULT_AES_KEY.equals(aesKey); - defaultJwsKeyInUse = DEFAULT_JWS_KEY.equals(jwsKey); - defaultAdminPasswordInUse = DEFAULT_ADMIN_PASSWORD.equals(adminPassword); - defaultAnonymousKeyInUse = DEFAULT_ANON_KEY.equals(anonymousKey); this.productionMode = productionMode; } diff --git a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java index 7c41140def..3f14e9739c 100644 --- a/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java +++ b/core/spring/src/main/java/org/apache/syncope/core/spring/security/SecurityContext.java @@ -120,7 +120,7 @@ public class SecurityContext { @Bean public DefaultCredentialChecker credentialChecker( final SecurityProperties props, - final JWSAlgorithm jwsAlgorithm) { + final JWSAlgorithm jwsAlgorithm) throws IOException { return new DefaultCredentialChecker( props.getAesSecretKey(), diff --git a/core/spring/src/main/resources/META-INF/default-credentials.properties b/core/spring/src/main/resources/META-INF/default-credentials.properties new file mode 100644 index 0000000000..8c96bdc4b6 --- /dev/null +++ b/core/spring/src/main/resources/META-INF/default-credentials.properties @@ -0,0 +1,20 @@ +# Licensed to the Apache Software Foundation (ASF) under one +# or more contributor license agreements. See the NOTICE file +# distributed with this work for additional information +# regarding copyright ownership. The ASF licenses this file +# to you under the Apache License, Version 2.0 (the +# "License"); you may not use this file except in compliance +# with the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, +# software distributed under the License is distributed on an +# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY +# KIND, either express or implied. See the License for the +# specific language governing permissions and limitations +# under the License. +default.aesSecretKey=${secretKey} +default.jwsKey=${jwsKey} +default.adminPassword=${adminPassword} +default.anonymousKey=${anonymousKey} diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java index 7d6d2d2757..11094b8ee3 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/SpringTestConfiguration.java @@ -47,7 +47,7 @@ public class SpringTestConfiguration { } @Bean - public EncryptorManager encryptorManager() { + public EncryptorManager encryptorManager() throws IOException { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(AES_SECRET_KEY); return new DefaultEncryptorManager(new DefaultCredentialChecker("", "", "", "", false), securityProperties); diff --git a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java index 1ff092f3ca..07286aea44 100644 --- a/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java +++ b/core/spring/src/test/java/org/apache/syncope/core/spring/security/DefaultEncryptorTest.java @@ -24,6 +24,7 @@ import static org.junit.jupiter.api.Assertions.assertNotNull; import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.assertTrue; +import java.io.IOException; import java.security.InvalidKeyException; import org.apache.syncope.common.lib.types.CipherAlgorithm; import org.apache.syncope.core.persistence.api.ApplicationContextProvider; @@ -39,7 +40,7 @@ public class DefaultEncryptorTest { private static Encryptor ENCRYPTOR; @BeforeAll - public static void setUp() { + public static void setUp() throws IOException { SecurityProperties props = new SecurityProperties(); props.setAesSecretKey(SpringTestConfiguration.AES_SECRET_KEY); ApplicationContextProvider.getBeanFactory().registerSingleton("securityProperties", props); diff --git a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java index 01f2c2d65d..af674efe1e 100644 --- a/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java +++ b/fit/core-reference/src/test/java/org/apache/syncope/fit/AbstractITCase.java @@ -1227,13 +1227,17 @@ public abstract class AbstractITCase { @Autowired protected DataSource testDataSource; - protected final EncryptorManager encryptorManager; + protected EncryptorManager encryptorManager; protected AbstractITCase() { SecurityProperties securityProperties = new SecurityProperties(); securityProperties.setAesSecretKey(StringUtils.EMPTY); securityProperties.setProductionMode(false); - encryptorManager = new DefaultEncryptorManager( - new DefaultCredentialChecker("", "", "", "", false), securityProperties); + try { + encryptorManager = new DefaultEncryptorManager( + new DefaultCredentialChecker("", "", "", "", false), securityProperties); + } catch (IOException e) { + fail(e.getMessage(), e); + } } }
