Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-1137

Default to sha1 hashes rather than the infrequently implemented atlassian-sha1

XMLWordPrintable

    • Icon: Bug Bug
    • Resolution: Obsolete
    • Icon: Low Low
    • None
    • None
    • Backend / Domain Model
    • None

      When one creates an internal directory (including in the setup wizard), one of the options is the "password encryption" type:

      As you can see, we default to "atlassian-sha1", and the note below virtually insists on it (who would install Crowd if they didn't want "compatibility between Atlassian products"?).

      This is terrible, because we're effectively locking user passwords into a proprietary format. In particular, LDAP directories don't support 'atlassian-sha1', which means users of the internal directory cannot migrate to a proper LDAP implementation, without losing their passwords.

        1. crowd_encryption.png
          crowd_encryption.png
          5 kB

            [CWD-1137] Default to sha1 hashes rather than the infrequently implemented atlassian-sha1

            Monique Khairuliana (Inactive) made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 - restricted [ 1511035 ] New: JAC Bug Workflow v3 [ 3365396 ]
            Status Original: Resolved [ 5 ] New: Closed [ 6 ]
            Owen made changes -
            Workflow Original: Simplified Crowd Development Workflow v2 [ 1393001 ] New: Simplified Crowd Development Workflow v2 - restricted [ 1511035 ]
            Owen made changes -
            Workflow Original: Crowd Development Workflow v2 [ 272890 ] New: Simplified Crowd Development Workflow v2 [ 1393001 ]

            joe added a comment -

            The install still ominously reads:

            Please see CWD-3812 for clarification.

            joe added a comment - The install still ominously reads: Please see CWD-3812 for clarification.

            prdonahue added a comment -

            Can you please elaborate on the fact that bcrypt is "a widely-supported option"?

            The install still ominously reads:

            "For compatibility between Atlassian products you must use ATLASSIAN-SECURITY."

            I really would prefer to use bcrypt, but it's more than a bit unclear which incompatibilities I would encounter?

            prdonahue added a comment - Can you please elaborate on the fact that bcrypt is "a widely-supported option"? The install still ominously reads: "For compatibility between Atlassian products you must use ATLASSIAN-SECURITY." I really would prefer to use bcrypt, but it's more than a bit unclear which incompatibilities I would encounter?
            joe made changes -
            Resolution New: Obsolete [ 11 ]
            Status Original: Open [ 1 ] New: Resolved [ 5 ]

            joe added a comment -

            As of 2.1.0, the default is Atlassian-Security (PKCS5S2, with random salt), so I'm closing this as obsolete. We also support bcrypt (CWD-2810) as a widely-supported option, but there are no plans to make it the default.

            joe added a comment - As of 2.1.0, the default is Atlassian-Security (PKCS5S2, with random salt), so I'm closing this as obsolete. We also support bcrypt ( CWD-2810 ) as a widely-supported option, but there are no plans to make it the default.
            joe made changes -
            Assignee Original: David O'Flynn [Atlassian] [ doflynn ]
            jawong.adm made changes -
            Workflow Original: JIRA Bug Workflow v2 [ 173552 ] New: Crowd Development Workflow v2 [ 272890 ]

            Bastian Schumacher added a comment -

            Hello Brendan,

            I'm sorry to tell you, that we got it never implemented. It had taken to much time, so I exported the users from the database (mysql), generated new passwords and imported them over the crowd importer. It has only affected about 30 people, so it wasn't such a big problem in our case.

            Bastian Schumacher added a comment - Hello Brendan, I'm sorry to tell you, that we got it never implemented. It had taken to much time, so I exported the users from the database (mysql), generated new passwords and imported them over the crowd importer. It has only affected about 30 people, so it wasn't such a big problem in our case.

              Unassigned Unassigned
              7ee5c68a815f Jeff Turner
              Affected customers:
              1 This affects my team
              Watchers:
              4 Start watching this issue

                Created:
                Updated:
                Resolved: