-
Bug
-
Resolution: Not a bug
-
Low
-
None
-
7.13.7, 7.18.1
-
None
-
6
-
Severity 3 - Minor
-
10
-
Issue Summary
According to Recognized System Properties, confluence.cluster.authentication.secret and confluence.cluster.authentication.enabled can be configured via system property. The confluence.cfg.xml value will always overwrite the secret configured via system property.
Steps to Reproduce
- Stop all nodes
- Remove confluence.cluster.authentication.enabled and confluence.cluster.authentication.secret entries in all node confluence.cfg.xmls and the shared home
- Configure the properties via Configuring System Properties
- Tested using a Linux box and setenv.sh entries
- Start up one of the nodes
Expected Results
- The secret used by the application becomes the value set as a system property
Actual Results
- The system properties are read in as noted in > General Configuration > System Information
- A new secret different from the system property entry is generated in confluence.cfg.xml
Workaround
Configure the secret via confluence.cluster.authentication.secret in confluence.cfg.xml
- relates to
-
CONFSERVER-78179 Confluence Data Center - Java Deserialization Vulnerability In Hazelcast - CVE-2016-10750
- Closed