Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixes #24651: Disallow clear-text API keys #5571

Closed
wants to merge 1 commit into from
Closed

Fixes #24651: Disallow clear-text API keys #5571

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 1 addition & 18 deletions ...ces/rudder/rudder-core/src/main/scala/com/normation/rudder/api/ApiAccountRepository.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,24 +164,7 @@ final class RoLDAPApiAccountRepository(
// here, be careful to the semantic of get with a filter!
optEntry <- ldap.get(rudderDit.API_ACCOUNTS.dn, BuildFilter.EQ(RudderLDAPConstants.A_API_TOKEN, hash))
optRes <- optEntry match {
case None => {
// Fallback on v1 clear text tokens
for {
optEntry <-
// here, be careful to the semantic of get with a filter!
ldap.get(rudderDit.API_ACCOUNTS.dn, BuildFilter.EQ(RudderLDAPConstants.A_API_TOKEN, token.value))
optRes <- optEntry match {
case None => None.succeed
case Some(e) =>
mapper
.entry2ApiAccount(e)
.map(Some(_))
.toIO
}
} yield {
optRes
}
}
case None => None.succeed
case Some(e) => mapper.entry2ApiAccount(e).map(Some(_)).toIO
}
} yield {
Expand Down
3 changes: 3 additions & 0 deletions ...p/sources/rudder/rudder-core/src/main/scala/com/normation/rudder/api/DataStructures.scala
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -64,6 +64,9 @@ final case class ApiAccountName(value: String) extends AnyVal
*
* * v1: 32 alphanumeric characters stored as clear text
* they are also displayed in clear text in the interface.
*
* REMOVED in 8.2.
*
* * v2: starting from Rudder 8.1, tokens are still 32 alphanumeric characters,
* but are now stored hashed in sha512 (128 characters), prefixed with "v2:".
* The tokens are only displayed once at creation.
Expand Down
5 changes: 2 additions & 3 deletions webapp/sources/rudder/rudder-web/src/main/elm/sources/Accounts/View.elm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -41,9 +41,8 @@ view model =
[ if hasClearTextTokens then
div [ class "alert alert-warning" ]
[ i [ class "fa fa-exclamation-triangle" ] []
, text "You have API accounts with tokens generated on a previous Rudder versions, those for which the "
, text "beginning of the token value is displayed in the table. They are now deprecated, you should "
, text "re-generate or replace them for improved security."
, text "You have API accounts with clear-text tokens generated before Rudder 8.0. "
, text "They don't work anymore, you need to re-generate or replace them."
]

else
Expand Down
8 changes: 1 addition & 7 deletions webapp/sources/rudder/rudder-web/src/main/elm/sources/Accounts/ViewUtils.elm
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -138,13 +138,7 @@ displayAccountsTable model =
if isEmpty a.token then
td [class "token"] [ span [class "token-txt"][ text "[hashed]" ] ]
else
td [class "token"]
[ span [class "token-txt"]
[text (slice 0 5 a.token)]
, span[class "fa hide-text"][]
, Html.a [ class "btn-goto clipboard", title "Copy to clipboard" , onClick (Copy a.token) ]
[ i [class "ion ion-clipboard"][] ]
]
td [class "token"] [ span [class "token-txt"][ text "TODO" ] ]
else
td [class "date"][ text (cleanDate a.creationDate) ]
, td [class "date"][ text expirationDate ]
Expand Down