[
https://issues.apache.org/jira/browse/NIFI-4942?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16426051#comment-16426051
]
Andy LoPresto commented on NIFI-4942:
-------------------------------------
I coordinated with Yolanda again today to discuss how Ambari would get the salt
and cost parameters for the hash generation (hashes with different salts/costs
cannot be compared directly, but rather each can be compared to the raw input
value. As we will not have access to this at the toolkit stage, the hash *must*
be generated with the same salt and costs that are stored for comparison). The
toolkit will provide a {{--current-hash-params}} flag to query the existing
salt and cost parameters in JSON format and then accept the hash generated with
those inputs.
Example:
{code}
$ ./bin/encrypt-config.sh --current-hash-params
{"N": "1024", "r": "8", "p": "1", salt: "ABCDEFGHIJKLMNOPQRSTUV"}
{code}
> NiFi Toolkit - Allow migration of master key without previous password
> ----------------------------------------------------------------------
>
> Key: NIFI-4942
> URL: https://issues.apache.org/jira/browse/NIFI-4942
> Project: Apache NiFi
> Issue Type: Improvement
> Components: Tools and Build
> Affects Versions: 1.5.0
> Reporter: Yolanda M. Davis
> Assignee: Andy LoPresto
> Priority: Major
>
> Currently the encryption cli in nifi toolkit requires that, in order to
> migrate from one master key to the next, the previous master key or password
> should be provided. In cases where the provisioning tool doesn't have the
> previous value available this becomes challenging to provide and may be prone
> to error. In speaking with [~alopresto] we can allow toolkit to support a
> mode of execution such that the master key can be updated without requiring
> the previous password. Also documentation around it's usage should be updated
> to be clear in describing the purpose and the type of environment where this
> command should be used (admin only access etc).
--
This message was sent by Atlassian JIRA
(v7.6.3#76005)
