How to rotate hmac secret ?

[leplatrem]

Currently, with the default BasicAuth authentication policy, a unique «userid» is generated from the tuple user:pass using the hmac secret in the settings.

If the hmac secret changes, the resulting «userid» will differ. Although technically the existing data won't disappear, the user won't be able to access them!

We have to identify every bit that relies on the hmac secret and make sure that we provide a mecanism to change it without consequence for the users.

Regarding BasicAuth, we could just list this among the limitations of this authentication policy.

Related #297

[Natim]

Note that even for non Basic Auth backend we are still using the hmac secret to generate the bucket ID of a given authenticated user.

[leplatrem]

generate the bucket ID of a given authenticated user

Oh. Well this is restricted to the default_bucket plugin...

[Natim]

Yes the bucket ID generated is the name of the user default bucket

[Natim]

After thinking this through the answer to this question is that we shouldn't need to rotate this secret.

This means that you should avoid using the default BasicAuth policy in production.
You should use #795 or #933 or any other authentication mecanism.

[leplatrem]

Agree.