[
https://issues.apache.org/jira/browse/SLING-13282?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18116835#comment-18116835
]
Konrad Windszus edited comment on SLING-13282 at 9/18/26 6:28 PM:
------------------------------------------------------------------
Thanks for the feedback.
Regarding
bq. i agree the encryption should be part if the caconfig impl as well
Can you suggest where exactly? I am not that familiar with the
ConfigurationManager API part used for writing...
bq. we need the option to replace the actual crypto implementation with
something else. so the EncryptionService interface should be moved to the SPI
package and be exposed
I think actually the CryptoService API at
<https://github.com/apache/sling-org-apache-sling-commons-crypto/blob/master/src/main/java/org/apache/sling/commons/crypto/CryptoService.java>
is enough as abstraction layer, no need for an additional one. That one can be
easily implemented by custom code. As multiple implementations are already
supported we just need a configurable way of hooking the CAConfig to one
implementation.
was (Author: kwin):
Thanks for the feedback.
Regarding
> i agree the encryption should be part if the caconfig impl as well
Can you suggest where exactly? I am not that familiar with the
ConfigurationManager API part used for writing...
> we need the option to replace the actual crypto implementation with something
> else. so the EncryptionService interface should be moved to the SPI package
> and be exposed
I think actually the CryptoService API at
<https://github.com/apache/sling-org-apache-sling-commons-crypto/blob/master/src/main/java/org/apache/sling/commons/crypto/CryptoService.java>
is enough as abstraction layer, no need for an additional one. That one can be
easily implemented by custom code. As multiple implementations are already
supported we just need a configurable way of hooking the CAConfig to one
implementation.
> Support automatic decryption in Context-Aware Configurations
> ------------------------------------------------------------
>
> Key: SLING-13282
> URL: https://issues.apache.org/jira/browse/SLING-13282
> Project: Sling
> Issue Type: Improvement
> Affects Versions: Context-Aware Configuration API 1.3.0, Context-Aware
> Configuration Impl 1.7.2
> Reporter: Konrad Windszus
> Assignee: Konrad Windszus
> Priority: Major
>
> The high-level API described at
> https://sling.apache.org/documentation/bundles/context-aware-configuration/context-aware-configuration.html#context-aware-configurations
> relies on annotations to map a property to an underlying resource property:
> https://sling.apache.org/documentation/bundles/context-aware-configuration/context-aware-configuration.html#describe-configurations-via-annotation-classes.
> Those should allow to optionally decrypt the underlying resource property
> while reading from the resource through
> https://sling.apache.org/documentation/bundles/commons-crypto.html#crypto-service.
> Either the annotation
> https://github.com/apache/sling-org-apache-sling-caconfig-api/blob/master/src/main/java/org/apache/sling/caconfig/annotation/Property.java
> could be extended with an additional boolean flag or one could use the
> existing {{properties}} element to use that.
> This is useful for sensitive data (like passwords, API keys, ...) which is
> site specific (and therefore hard to store inside OSGi configurations) but
> should nevertheless not be stored in clear text in the underlying repository.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
