sergehuber opened a new pull request, #846: URL: https://github.com/apache/unomi/pull/846
## Summary Implements [UNOMI-972](https://issues.apache.org/jira/browse/UNOMI-972): defense-in-depth hardening for Unomi 3.1 around credentials, public context profile binding, and privileged extension/admin actions. This PR replaces #842 (same change set; branch renamed to include the Jira key). ## Changes ### 1. Explicit admin and health passwords at startup - Require `UNOMI_ROOT_PASSWORD` and `UNOMI_HEALTHCHECK_PASSWORD` before the runtime starts (`setenv` / `setenv.bat`, Docker entrypoint). - Stop shipping known default passwords in packaging and sample compose files; compose examples document the required variables. - Update getting-started, configuration, and Docker docs so operators must set strong credentials deliberately. ### 2. Stronger public context / eventcollector profile binding For **unauthenticated / public** callers of context and eventcollector: - Treat the profile cookie as the only profile identity bearer. - Ignore a client-supplied `profileId` in the request body (so public clients cannot select an arbitrary profile that way). - Refuse session-driven profile switches unless the cookie already matches the target profile. - Default the profile cookie `HttpOnly` flag to `true` (configurable via existing web settings). Authenticated / private-key callers keep the previous ability to bind profiles intentionally for admin and integration use cases. ### 3. Restrict privileged extension REST endpoints - Annotate Groovy Actions REST and Router import/export REST endpoints with `@RequiresRole(ADMINISTRATOR)` so only the system administrator role can use them (not a tenant administrator). ### 4. Gate cross-profile merge and system property updates - `MergeProfilesOnPropertyAction` and `UpdatePropertiesAction` refuse cross-profile merge/update and `systemProperties.*` writes unless the caller is a trusted identity (system administrator or tenant administrator). ### Docs and threat model - Align `SECURITY.md` / `THREAT_MODEL.md` with the above operational expectations (no vulnerability write-ups; configuration and trust-boundary guidance only). ## Test plan - [ ] `ShippedAdminPasswordConfigTest` - [ ] `RestServiceUtilsImplProfileBindingTest` - [ ] `GroovyActionsEndPointRoleTest`, `RouterConfigurationEndPointRoleTest` - [ ] `MergeProfilesOnPropertyActionTest`, `UpdatePropertiesActionTest` - [ ] `ContextServletIT` public vs private binding cases - [ ] `RestEndpointRoleSecurityIT` - [ ] `ProfileMergeIT` / `PropertiesUpdateActionIT` trusted vs untrusted - [ ] Smoke: Docker/compose fails closed without both password env vars -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
