Details
-
Suggestion
-
Resolution: Done
Description
Hello everyone,
We’re happy to inform you that we’ve released Crowd 4.2 which encrypts all passwords to external systems that are stored in the Crowd’s database. These are:
- Passwords that allows Crowd to connect to LDAP / AD directory
- Remote Crowd directory application passwords
- Azure AD web application keys
- SMTP mail passwords
- Proxy passwords
We’d like to emphasize that the encryption of application.password stored in crowd.properties file which is used by clients connecting to Crowd is not in the scope of this ticket. This suggestion is tracked in another ticket: CWD-5649.
Best regards,
Crowd team
Anywhere that a password is stored in plaintext in Crowd's database, it should be encrypted. This will not stop a knowledgeable attacker, but may slow them down.
Attachments
Issue Links
- blocks
-
JRASERVER-38609 Crowd User Directory application password stored in plain text
-
- Closed
-
- incorporates
-
- Closed
- is duplicated by
-
- Closed
-
- Closed
-
- Closed
- relates to
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
-
- Closed
-
-
- Closed
-
LEM-359 Loading...
- is cloned by
-
- mentioned in
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
