sergehuber opened a new pull request, #850: URL: https://github.com/apache/unomi/pull/850
The shipped karaf and health-check accounts fell back to a value carried in the distribution when the operator set nothing. Both now resolve only from UNOMI_ROOT_PASSWORD and UNOMI_HEALTHCHECK_PASSWORD, with no fallback. Removing the fallback is necessary but not sufficient, because of how Karaf resolves properties: PropertiesLoader and PropertiesLoginModule both substitute with defaultsToEmptyString=true, so an unset property yields an empty value rather than an unusable account. The account must therefore be made unusable deliberately. bin/setenv and the Docker entrypoint refuse to start when either variable is unset, and AuthenticationFilter requires a non-blank password on any Basic credential it accepts. That last check runs at each point a Basic credential is consumed rather than once at the top of filter(). The public paths and every V2 path ignore Authorization entirely, so a single up-front check would turn a stray or stale header into a 401 on requests that must succeed anonymously. The shell guards cannot cover every way the JVM is started - karaf.bat calls setenv.bat without testing errorlevel, as setenv itself documents, and a systemd unit or container command override skips them too - so the REST-layer requirement is what actually holds. The guards are executed by the tests rather than grepped, because a check whose text is present but whose condition never matches would otherwise pass silently. Documentation, examples, compose files and the setup scripts no longer carry a sample password. Operators upgrading must set both variables before starting; the 3.0-to-3.1 migration guide covers it. Jira: https://issues.apache.org/jira/browse/UNOMI-974 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
