[
https://issues.apache.org/jira/browse/SOLR-15525?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17382312#comment-17382312
]
Timothy Potter commented on SOLR-15525:
---------------------------------------
I'm dis-inclined to revert my commit (not sure if that's what you're suggesting
I do?) as my goal was to keep the change as simple as possible. Adding two more
providers impls. seemed a bit awkward given the minor improvement I was making
and my change still relies on reading a Java system property to identify the
file to read, so it didn't seem to me like a big deal to just add this to the
existing impls and re-use the test code in place.
I agree the framework could use some refactoring as you've suggested in 15548,
but that wasn't my goal in this issue. Are you going to work on 15548 before
8.10 is released? If so, you're welcome to remove my changes here. Otherwise,
let me know if you want me to introduce the FileBasedZkACLProvider and
FileBasedZkCredentialsProvider classes using the current framework before 8.10
(my changes have already hit 8x)
> Provide zkCredentialsProvider and zkACLProvider that loads credentials from a
> file or env vars instead of sys props
> -------------------------------------------------------------------------------------------------------------------
>
> Key: SOLR-15525
> URL: https://issues.apache.org/jira/browse/SOLR-15525
> Project: Solr
> Issue Type: Improvement
> Security Level: Public(Default Security Level. Issues are Public)
> Components: security
> Reporter: Timothy Potter
> Assignee: Timothy Potter
> Priority: Minor
> Fix For: main (9.0), 8.10
>
> Time Spent: 3h 10m
> Remaining Estimate: 0h
>
> Currently, the {{VMParamsSingleSetCredentialsDigestZkCredentialsProvider}}
> and {{VMParamsAllAndReadonlyDigestZkACLProvider}} load ZK credentials from
> Java system properties. Solr should provide an alternative impl to load this
> information from a file (and maybe env vars too). This avoids leaking the
> credentials in the JVM system properties that get logged as well as shown in
> the UI.
> It would also be nice if this file could store the credentials encrypted, as
> suggested by SOLR-11655, however that requires a global encryption password
> (such as http://www.jasypt.org/) so is merely security through obscurity b/c
> anyone with shell access could track down this encryption password and
> decrypt the ZK credentials in the file. Of course every Solr node has its own
> private key for the PKI auth frmk, but that's not helpful for this problem
> because the encryption key needs to be shared among all the nodes so they can
> decrypt the ZK creds. So I'm going to skip that part for now and just
> implement loading the plain-text creds from a file.
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
