bitflicker64 commented on code in PR #526:
URL: https://github.com/apache/hugegraph-doc/pull/526#discussion_r4264902024
##########
content/en/docs/config/config-option.md:
##########
@@ -69,6 +69,7 @@ Corresponding configuration file `rest-server.properties`
| auth.authenticator |
| The class path of authenticator implementation. e.g.,
org.apache.hugegraph.auth.StandardAuthenticator, or a custom implementation.
|
| auth.graph_store | hugegraph
| The name of graph used to store authentication information, like
users, only for org.apache.hugegraph.auth.StandardAuthenticator.
|
| auth.admin_pa | pa | Used when the Server startup path initializes admin.
Explicitly set a strong password before production deployment; the public
default is `pa`. On local persistent backends, `init-store.sh` prompts for the
initial password. |
+| auth.admin_pa_file | | Path of a regular file (symlinks are followed)
holding the initial password for the built-in admin account. The file is read
as raw UTF-8 with a leading BOM and one trailing line break removed, so spaces,
backslashes and non-ASCII characters need no properties escaping. The password
may be at most 72 bytes in UTF-8, because the password hash ignores anything
after that. When set, it takes precedence over `auth.admin_pa` and the
`init-store.sh` password prompt. A file that is missing, unreadable, not a
regular file, larger than 4096 bytes, not valid UTF-8, empty, or holding a
password longer than 72 bytes stops `init-store.sh` or Server startup. The
password is only applied when the admin account is first created, but with PD
(hstore) and non-persistent backends the file is read on every start, so keep
it readable for as long as the option is set. |
Review Comment:
Important: this row, the `rest-server.properties` example in
`config-authentication.md` and the `init_store.enabled=false` paragraph in
`config-backend-hstore.md` present `auth.admin_pa_file` as available, in EN and
CN, without saying which Server has it. No released Server and not even current
master has the option (apache/hugegraph#3334 is still open), and a Server
without it does not reject the key.
Evidence, apache/hugegraph master 0b7c0de: `git grep admin_pa_file` finds
nothing. `HugeConfig.addPropertyDirect` only logs `The config option '{}' is
redundant, please ensure it has been registered` for an unregistered key and
carries on. `GraphManager.loadMetaFromPD()` (GraphManager.java:375-377) then
calls `initAdminUserIfNeeded(conf.get(ServerOptions.ADMIN_PA))`, and the
non-persistent path in `checkBackendVersionOrExit` reads
`ServerOptions.ADMIN_PA` as well, whose default is `pa`. So an operator on such
a Server who follows this row, sets only `auth.admin_pa_file` and leaves
`auth.admin_pa` unset gets the admin account created with the public password
`pa` on PD (hstore) with init-store enabled and on the memory backend, with one
WARN line as the only sign. On local persistent backends `init-store.sh` falls
back to the interactive prompt instead of reading the file. Merging this after
#3334 does not cover readers on an older release. The other pages in this
directory already
mark version-bound behaviour (`Since 1.7.0 ...` in
`config-backend-hstore.md:80`, `applies only to images built from master` in
`config-guide.md:39`), and the hstore table this PR extends says its facts were
checked at Server master `2f827d6`, where the option does not exist.
Requested change: state the first Server version that supports
`auth.admin_pa_file` (or that it is master-only until that release) in this row
and in the CN row at `content/cn/docs/config/config-option.md:72`, and add the
same note to the two properties comments and the two hstore paragraphs. Say
there that an older Server ignores the option, so `auth.admin_pa` still has to
be set on it.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
