Serge Huber created UNOMI-974:
---------------------------------
Summary: Require an explicit administrator and health-check
password at startup
Key: UNOMI-974
URL: https://issues.apache.org/jira/browse/UNOMI-974
Project: Apache Unomi
Issue Type: Improvement
Components: unomi(-core)
Affects Versions: unomi-3.1.0
Reporter: Serge Huber
Assignee: Serge Huber
Fix For: unomi-3.1.0
h2. Current behaviour
{{users.properties}} resolves the shipped {{karaf}} and health-check accounts
through
{{${...:-karaf}}} / {{${...:-health}}}, so a deployment that configures nothing
still authenticates
with a value that ships in the distribution.
Removing the fallback alone is not sufficient. Karaf's {{PropertiesLoader}} and
{{PropertiesLoginModule}} both substitute with {{defaultsToEmptyString=true}},
so an unset property
expands to the empty string and the accounts would simply accept an empty
password instead.
h2. Change
* {{users.properties}} and {{custom.system.properties}} carry no fallback
value. The passwords come
from {{UNOMI_ROOT_PASSWORD}} and {{UNOMI_HEALTHCHECK_PASSWORD}}.
* {{bin/setenv}} and the Docker entrypoint refuse to start when either variable
is unset.
* {{AuthenticationFilter}} rejects a Basic credential with a blank password, at
each point where one
is consumed rather than once up front — the public and V2 paths ignore
{{Authorization}}
entirely, so an up-front reject would 401 requests that must succeed
anonymously.
* Documentation, examples, Docker compose files and the setup scripts no longer
show {{karaf:karaf}}.
h2. Known limitation
{{karaf.bat}} invokes {{setenv.bat}} with {{call}} and does not test
{{errorlevel}}, so on Windows
the check warns but cannot halt startup. Any launcher that execs the JVM
directly (systemd,
Kubernetes command overrides) likewise bypasses the shell guard. This is why
the REST-layer rejection
exists as defence in depth. Documented in {{setenv}} itself.
h2. Tests
* {{ShippedAdminPasswordConfigTest}} (21) — *executes* the launcher guards
rather than grepping
them, because a check whose text is present but whose condition never matches
passes silently.
* {{AuthenticationFilterBlankPasswordTest}} (13).
* {{BaseIT}}, {{BasicIT}}, {{HealthCheckIT}}, {{TenantIT}},
{{V2CompatibilityModeIT}},
{{BaseGraphQLIT}} updated to supply explicit credentials.
h2. Upgrade impact
Breaking for any deployment that relied on the shipped default: operators must
set both environment
variables before starting. Covered in {{migrate-3.0-to-3.1.adoc}}.
h2. Backport
Unless requested these changes will not be backported.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
