Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-2668

Strip passwords when logging directory data

    XMLWordPrintable

Details

    • Suggestion
    • Resolution: Fixed
    • 2.3.4
    • None
    • None
    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

    Description

      If a DirectoryImpl object is ever logged using its toString method, it will output log messages containing all attributes without any filtering on the results. e.g.

      2011-03-25 12:14:23,510 INFO [main] [confluence.upgrade.upgradetask.EmbeddedCrowdSynchronisationUpgradeTask] doUpgrade Starting initial sync of directory: com.atlassian.crowd.model.directory.DirectoryImpl@c2b8eb[lowerName=upgraded atlassian-user ldap (ldaprepository),description=LDAP configuration upgraded from an existing atlassian-user configuration,type=CONNECTOR,implementationClass=com.atlassian.crowd.directory.MicrosoftActiveDirectory,allowedOperations=[UPDATE_GROUP_ATTRIBUTE, CREATE_GROUP, UPDATE_USER_ATTRIBUTE, DELETE_GROUP, UPDATE_GROUP],attributes={ldap.read.timeout=60000, ldap.user.displayname=displayName, ldap.pooling=true, ldap.role.name=cn, ldap.usermembership.use=false, ldap.search.timelimit=0, ldap.user.objectclass=person, ldap.group.objectclass=group, ldap.role.description=description, ldap.user.firstname=givenname, ldap.pagedresults=true, ldap.group.description=cn, ldap.group.usernames=member, ldap.user.group=memberOf, ldap.user.filter=(objectClass=person), ldap.user.username.rdn=sAMAccountName, ldap.password=*******, ldap.relaxed.dn.standardisation=false, ldap.secure=false, ldap.role.usernames=member, ldap.group.filter=(objectClass=group), ldap.user.username=sAMAccountName, ldap.group.dn=ou=Groups, ldap.user.email=mail, ldap.basedn=ou=UserBase,dc=corp,dc=hulu,dc=com, ldap.role.filter=(objectclass=group), ldap.roles.disabled=true, ldap.connection.timeout=30000, ldap.url=ldap://somecompany:389, ldap.usermembership.use.for.groups=false, ldap.referral=true, ldap.userdn=CN=Linux-LDAP,OU=ServiceAccounts,OU=UserBase,DC=corp,DC=hulu,DC=com, ldap.user.lastname=sn, ldap.pagedresults.size=100, ldap.group.name=cn, ldap.local.groups=true, ldap.user.dn=, ldap.user.password=unicodePwd, ldap.role.objectclass=group}]
      

      Note that the ldap.password in this example has been sanitised. Crowd should automatically do this whenever it logs a directory object - be it a DirectoryImpl or an ImmutableDirectory (should we ever add a toString implementation to that).

      Attachments

        Issue Links

          Activity

            People

              jwalton joe
              richatkins Richard Atkins
              Votes:
              0 Vote for this issue
              Watchers:
              0 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved:

                Time Tracking

                  Estimated:
                  Original Estimate - 1h Original Estimate - 1h
                  1h
                  Remaining:
                  Remaining Estimate - 0h
                  0h
                  Logged:
                  Time Spent - 1.5h
                  1.5h