sergehuber opened a new pull request, #846:
URL: https://github.com/apache/unomi/pull/846

   ## Summary
   
   Implements [UNOMI-972](https://issues.apache.org/jira/browse/UNOMI-972): 
defense-in-depth hardening for Unomi 3.1 around credentials, public context 
profile binding, and privileged extension/admin actions.
   
   This PR replaces #842 (same change set; branch renamed to include the Jira 
key).
   
   ## Changes
   
   ### 1. Explicit admin and health passwords at startup
   
   - Require `UNOMI_ROOT_PASSWORD` and `UNOMI_HEALTHCHECK_PASSWORD` before the 
runtime starts (`setenv` / `setenv.bat`, Docker entrypoint).
   - Stop shipping known default passwords in packaging and sample compose 
files; compose examples document the required variables.
   - Update getting-started, configuration, and Docker docs so operators must 
set strong credentials deliberately.
   
   ### 2. Stronger public context / eventcollector profile binding
   
   For **unauthenticated / public** callers of context and eventcollector:
   
   - Treat the profile cookie as the only profile identity bearer.
   - Ignore a client-supplied `profileId` in the request body (so public 
clients cannot select an arbitrary profile that way).
   - Refuse session-driven profile switches unless the cookie already matches 
the target profile.
   - Default the profile cookie `HttpOnly` flag to `true` (configurable via 
existing web settings).
   
   Authenticated / private-key callers keep the previous ability to bind 
profiles intentionally for admin and integration use cases.
   
   ### 3. Restrict privileged extension REST endpoints
   
   - Annotate Groovy Actions REST and Router import/export REST endpoints with 
`@RequiresRole(ADMINISTRATOR)` so only the system administrator role can use 
them (not a tenant administrator).
   
   ### 4. Gate cross-profile merge and system property updates
   
   - `MergeProfilesOnPropertyAction` and `UpdatePropertiesAction` refuse 
cross-profile merge/update and `systemProperties.*` writes unless the caller is 
a trusted identity (system administrator or tenant administrator).
   
   ### Docs and threat model
   
   - Align `SECURITY.md` / `THREAT_MODEL.md` with the above operational 
expectations (no vulnerability write-ups; configuration and trust-boundary 
guidance only).
   
   ## Test plan
   
   - [ ] `ShippedAdminPasswordConfigTest`
   - [ ] `RestServiceUtilsImplProfileBindingTest`
   - [ ] `GroovyActionsEndPointRoleTest`, `RouterConfigurationEndPointRoleTest`
   - [ ] `MergeProfilesOnPropertyActionTest`, `UpdatePropertiesActionTest`
   - [ ] `ContextServletIT` public vs private binding cases
   - [ ] `RestEndpointRoleSecurityIT`
   - [ ] `ProfileMergeIT` / `PropertiesUpdateActionIT` trusted vs untrusted
   - [ ] Smoke: Docker/compose fails closed without both password env vars


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to