Skip to content

Commit

Permalink
Extend set of masked fields in ConfigXmlGenerator [HZ-2289] (5.1.z) (#…
Browse files Browse the repository at this point in the history 
…24308)
  • Loading branch information
@kwart
kwart committed Apr 20, 2023
1 parent 7bf76c6 commit 40d054f
Show file tree
Hide file tree
Showing 2 changed files with 33 additions and 18 deletions.
13 changes: 8 additions & 5 deletions hazelcast/src/main/java/com/hazelcast/config/ConfigXmlGenerator.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -205,6 +205,9 @@ public String generate(Config config) {
}

private String getOrMaskValue(String value) {
if (value == null) {
return null;
}
return maskSensitiveFields ? MASK_FOR_SENSITIVE_DATA : value;
}

Expand Down Expand Up @@ -319,7 +322,7 @@ private static void tlsAuthenticationGenerator(XmlGenerator gen, TlsAuthenticati
.close();
}

private static void ldapAuthenticationGenerator(XmlGenerator gen, LdapAuthenticationConfig c) {
private void ldapAuthenticationGenerator(XmlGenerator gen, LdapAuthenticationConfig c) {
if (c == null) {
return;
}
Expand All @@ -336,7 +339,7 @@ private static void ldapAuthenticationGenerator(XmlGenerator gen, LdapAuthentica
.nodeIfContents("role-search-scope", c.getRoleSearchScope())
.nodeIfContents("user-name-attribute", c.getUserNameAttribute())
.nodeIfContents("system-user-dn", c.getSystemUserDn())
.nodeIfContents("system-user-password", c.getSystemUserPassword())
.nodeIfContents("system-user-password", getOrMaskValue(c.getSystemUserPassword()))
.nodeIfContents("system-authentication", c.getSystemAuthentication())
.nodeIfContents("security-realm", c.getSecurityRealm())
.nodeIfContents("password-attribute", c.getPasswordAttribute())
Expand All @@ -347,7 +350,7 @@ private static void ldapAuthenticationGenerator(XmlGenerator gen, LdapAuthentica
.close();
}

private static void kerberosAuthenticationGenerator(XmlGenerator gen, KerberosAuthenticationConfig c) {
private void kerberosAuthenticationGenerator(XmlGenerator gen, KerberosAuthenticationConfig c) {
if (c == null) {
return;
}
Expand All @@ -362,14 +365,14 @@ private static void kerberosAuthenticationGenerator(XmlGenerator gen, KerberosAu
kerberosGen.close();
}

private static void simpleAuthenticationGenerator(XmlGenerator gen, SimpleAuthenticationConfig c) {
private void simpleAuthenticationGenerator(XmlGenerator gen, SimpleAuthenticationConfig c) {
if (c == null) {
return;
}
XmlGenerator simpleGen = gen.open("simple");
addClusterLoginElements(simpleGen, c).nodeIfContents("role-separator", c.getRoleSeparator());
for (String username : c.getUsernames()) {
simpleGen.open("user", "username", username, "password", c.getPassword(username));
simpleGen.open("user", "username", username, "password", getOrMaskValue(c.getPassword(username)));
for (String role : c.getRoles(username)) {
simpleGen.node("role", role);
}
Expand Down
38 changes: 25 additions & 13 deletions hazelcast/src/test/java/com/hazelcast/config/ConfigXmlGeneratorTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -109,17 +109,29 @@ public void testIfSensitiveDataIsMasked_whenMaskingEnabled() {
cfg.getNetworkConfig().setSymmetricEncryptionConfig(symmetricEncryptionConfig);
cfg.setLicenseKey("HazelcastLicenseKey");

cfg.getSecurityConfig().addRealmConfig("simple",
new RealmConfig().setSimpleAuthenticationConfig(new SimpleAuthenticationConfig().addUser("test", "pass"))
.setUsernamePasswordIdentityConfig("myidentity", "mypasswd"))
.addRealmConfig("ldap", new RealmConfig().setLdapAuthenticationConfig(
new LdapAuthenticationConfig().setSystemUserDn("cn=test").setSystemUserPassword("ldappass")));

Config newConfigViaXMLGenerator = getNewConfigViaXMLGenerator(cfg);
SSLConfig generatedSSLConfig = newConfigViaXMLGenerator.getNetworkConfig().getSSLConfig();
SecurityConfig secCfg = newConfigViaXMLGenerator.getSecurityConfig();

assertEquals(generatedSSLConfig.getProperty("keyStorePassword"), MASK_FOR_SENSITIVE_DATA);
assertEquals(generatedSSLConfig.getProperty("trustStorePassword"), MASK_FOR_SENSITIVE_DATA);
assertEquals(MASK_FOR_SENSITIVE_DATA, generatedSSLConfig.getProperty("keyStorePassword"));
assertEquals(MASK_FOR_SENSITIVE_DATA, generatedSSLConfig.getProperty("trustStorePassword"));

String secPassword = newConfigViaXMLGenerator.getNetworkConfig().getSymmetricEncryptionConfig().getPassword();
String theSalt = newConfigViaXMLGenerator.getNetworkConfig().getSymmetricEncryptionConfig().getSalt();
assertEquals(secPassword, MASK_FOR_SENSITIVE_DATA);
assertEquals(theSalt, MASK_FOR_SENSITIVE_DATA);
assertEquals(newConfigViaXMLGenerator.getLicenseKey(), MASK_FOR_SENSITIVE_DATA);
assertEquals(MASK_FOR_SENSITIVE_DATA, secPassword);
assertEquals(MASK_FOR_SENSITIVE_DATA, theSalt);
assertEquals(MASK_FOR_SENSITIVE_DATA, newConfigViaXMLGenerator.getLicenseKey());
RealmConfig simpleRealm = secCfg.getRealmConfig("simple");
assertEquals(MASK_FOR_SENSITIVE_DATA, simpleRealm.getSimpleAuthenticationConfig().getPassword("test"));
assertEquals(MASK_FOR_SENSITIVE_DATA, simpleRealm.getUsernamePasswordIdentityConfig().getPassword());
assertEquals(MASK_FOR_SENSITIVE_DATA,
secCfg.getRealmConfig("ldap").getLdapAuthenticationConfig().getSystemUserPassword());
}

@Test
Expand All @@ -146,17 +158,17 @@ public void testIfSensitiveDataIsNotMasked_whenMaskingDisabled() {
Config newConfigViaXMLGenerator = getNewConfigViaXMLGenerator(cfg, false);
SSLConfig generatedSSLConfig = newConfigViaXMLGenerator.getNetworkConfig().getSSLConfig();

assertEquals(generatedSSLConfig.getProperty("keyStorePassword"), password);
assertEquals(generatedSSLConfig.getProperty("trustStorePassword"), password);
assertEquals(password, generatedSSLConfig.getProperty("keyStorePassword"));
assertEquals(password, generatedSSLConfig.getProperty("trustStorePassword"));

String secPassword = newConfigViaXMLGenerator.getNetworkConfig().getSymmetricEncryptionConfig().getPassword();
String theSalt = newConfigViaXMLGenerator.getNetworkConfig().getSymmetricEncryptionConfig().getSalt();
assertEquals(secPassword, password);
assertEquals(theSalt, salt);
assertEquals(newConfigViaXMLGenerator.getLicenseKey(), licenseKey);
assertEquals(password, secPassword);
assertEquals(salt, theSalt);
assertEquals(licenseKey, newConfigViaXMLGenerator.getLicenseKey());
SecurityConfig securityConfig = newConfigViaXMLGenerator.getSecurityConfig();
RealmConfig realmConfig = securityConfig.getRealmConfig(securityConfig.getMemberRealm());
assertEquals(realmConfig.getUsernamePasswordIdentityConfig().getPassword(), password);
assertEquals(password, realmConfig.getUsernamePasswordIdentityConfig().getPassword());
}

private MemberAddressProviderConfig getMemberAddressProviderConfig(Config cfg) {
Expand Down Expand Up @@ -647,7 +659,7 @@ public void testLdapConfig() {
SecurityConfig expectedConfig = new SecurityConfig().setClientRealmConfig("ldapRealm", realmConfig);
cfg.setSecurityConfig(expectedConfig);

SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg).getSecurityConfig();
SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg, false).getSecurityConfig();
assertEquals(expectedConfig, actualConfig);
}

Expand Down Expand Up @@ -705,7 +717,7 @@ public void testSimpleAuthenticationConfig() {
);
SecurityConfig expectedConfig = new SecurityConfig().setMemberRealmConfig("simpleRealm", realmConfig);
cfg.setSecurityConfig(expectedConfig);
SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg).getSecurityConfig();
SecurityConfig actualConfig = getNewConfigViaXMLGenerator(cfg, false).getSecurityConfig();
assertEquals(expectedConfig, actualConfig);
}

Expand Down

0 comments on commit 40d054f

Please sign in to comment.