[
https://issues.apache.org/jira/browse/DERBY-5651?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=13230115#comment-13230115
]
Rick Hillegas commented on DERBY-5651:
--------------------------------------
If I understand password substitution correctly, it can only be used when the
server knows the cleartext password, i.e., it can only be employed when BUILTIN
authentication is on and passwords are declared in cleartext on the VM boot
command or in derby.properties. This is arguably the least secure of Derby's
authentication schemes. I think that using password substitution to protect
this scenario is nearly pointless. Are you suggesting that we simply remove the
substitution logic and raise a warning if securityMechanism=8 is specified? I
think that the backward compatibility issues with that change would be minor
and acceptable. Thanks.
> Protocol error when connecting to db with NATIVE authentication using strong
> password substitution
> --------------------------------------------------------------------------------------------------
>
> Key: DERBY-5651
> URL: https://issues.apache.org/jira/browse/DERBY-5651
> Project: Derby
> Issue Type: Bug
> Components: Network Server, Services
> Affects Versions: 10.9.0.0
> Reporter: Knut Anders Hatlen
>
> If you connect to a db with native authentication using strong password
> substitution to protect the password, you'll get a protocol error:
> ij(CONNECTION2)> connect
> 'jdbc:derby://localhost/db;user=app;password=papp;securityMechanism=8';
> ERROR 08006: A network protocol error was encountered and the connection has
> been terminated: A PROTOCOL Data Stream Syntax Error was detected. Reason:
> 0x18. Plaintext connection attempt to an SSL enabled server?
> I don't think strong password substitution is intended to work with NATIVE,
> but it should probably fail more gracefully. With BUILTIN, you'll get a more
> helpful error message:
> ij(CONNECTION5)> connect
> 'jdbc:derby://localhost/db2;user=app;password=papp;securityMechanism=8';
> ERROR 08004: DERBY SQL error: SQLCODE: -1, SQLSTATE: 08004, SQLERRMC:
> Connection authentication failure occurred. Either the supplied credentials
> were invalid, or the database uses a password encryption scheme not
> compatible with the strong password substitution security mechanism. If this
> error started after upgrade, refer to the release note for DERBY-4483 for
> options.
--
This message is automatically generated by JIRA.
If you think it was sent incorrectly, please contact your JIRA administrators:
https://issues.apache.org/jira/secure/ContactAdministrators!default.jspa
For more information on JIRA, see: http://www.atlassian.com/software/jira
