oscerd opened a new issue, #2959:
URL: https://github.com/apache/camel-kamelets/issues/2959
Two credential-metadata cleanups.
**1. Thirteen credential properties declare `x-descriptors` but not `format:
password`**
The authoring convention is `format: password` **plus** `x-descriptors:
[urn:camel:group:credentials]`. These thirteen declarations have the descriptor
but not the format, so tooling that keys off `format` does not mask them:
`serviceAccountKey` (8):
- `google-bigquery-sink`, `google-functions-sink`, `google-pubsub-sink`,
`google-pubsub-source`, `google-storage-sink`, `google-storage-source`,
`google-storage-event-based-source`, `google-vertexai-sink`
`personal-token` (5):
- `jira-add-comment-sink`, `jira-add-issue-sink`, `jira-source`,
`jira-transition-issue-sink`, `jira-update-issue-sink`
Sibling `password` properties in the same files are marked correctly, so
this looks like drift rather than intent. Worth adding a co-occurrence check to
`kamelets-maven-plugin` so it cannot regress.
**2. Databricks access token is duplicated into the datasource URL**
```
kamelets/databricks-source.kamelet.yaml:102
kamelets/databricks-sink.kamelet.yaml:92
```
```
url:
'jdbc:databricks://{{serverHostname}}:{{serverPort}};httpPath={{httpPath}};AuthMech=3;transportMode=http;ssl=1;UID=token;PWD={{accessToken}}{{extraOptions}}'
```
Both beans already set `password: '{{accessToken}}'` on the
`BasicDataSource`, which is the field tooling knows to mask. Carrying the token
a second time inside `url` — an ordinary non-secret string that shows up in JMX
and in connection-failure messages — is redundant.
Removing `;UID=token;PWD={{accessToken}}` from the URL needs `username:
'token'` added to the bean to replace the `UID=token` the URL was supplying:
```yaml
- name: dsBean
type: "#class:org.apache.commons.dbcp2.BasicDataSource"
properties:
username: 'token'
password: '{{accessToken}}'
url:
'jdbc:databricks://{{serverHostname}}:{{serverPort}};httpPath={{httpPath}};AuthMech=3;transportMode=http;ssl=1{{extraOptions}}'
driverClassName: 'com.databricks.client.jdbc.Driver'
```
Worth verifying against the Databricks JDBC driver that `AuthMech=3` picks
up the DataSource-level user/password before merging.
_Claude Code on behalf of Andrea Cosentino_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
