Uploaded image for project: 'Crowd Data Center'
  1. Crowd Data Center
  2. CWD-4071

Encrypt Database Password in crowd.cfg.xml or use integrated authentication

    • Icon: Suggestion Suggestion
    • Resolution: Done
    • 5.1.0
    • None
    • None
    • Our product teams collect and evaluate feedback from a number of different sources. To learn more about how we use customer feedback in the planning process, check out our new feature policy.

      Currently database password is stored in plain text format in crowd_home/crowd.cfg.xml file property “hibernate.connection.password”

      Crowd should Encrypt the database password since it's in plain text in the crowd.cfg.xml l file or it could use the integrated authentication with the databases such as MSSQL database.

            [CWD-4071] Encrypt Database Password in crowd.cfg.xml or use integrated authentication

            Alex Burt added a comment - - edited

            It is hard to believe Atlassian has completely blown this simple fix off for more than a decade, and won't bother to implement it. 

            Alex Burt added a comment - - edited It is hard to believe Atlassian has completely blown this simple fix off for more than a decade, and won't bother to implement it. 

            KGrandhi added a comment - - edited

            Understand that Atlassian is using Hashicorp vault to address security vulnerabilities  as per https://www.hashicorp.com/resources/how-hashicorp-vault-solves-the-top-3-cloud-security  it would be helpful to other organizations if DB passwords are encrypted like Jira https://confluence.atlassian.com/jiracore/advanced-encryption-975040999.html . Hope Atlassian add pass encryption feature to all Atlassian products soon. 

             

            Update:: 2022/08/19

            Confluence and Bamboo now incorporate DB password encryption but still CROWD doesn't have this  DB password encryption feature. Our Information Security is mandating to encrypt all plain text passwords. Hope Atlassian adds pass encryption feature to CROWD soon. 

             

            KGrandhi added a comment - - edited Understand that Atlassian is using Hashicorp vault to address security vulnerabilities  as per https://www.hashicorp.com/resources/how-hashicorp-vault-solves-the-top-3-cloud-security   it would be helpful to other organizations if DB passwords are encrypted like Jira https://confluence.atlassian.com/jiracore/advanced-encryption-975040999.html  . Hope Atlassian add pass encryption feature to all Atlassian products soon.    Update:: 2022/08/19 Confluence and Bamboo now incorporate DB password encryption but still CROWD doesn't have this  DB password encryption feature. Our Information Security is mandating to encrypt all plain text passwords. Hope Atlassian adds pass encryption feature to CROWD soon.   

            I would be happy if they officially supported setting these passwords via environment variables. That way, we can use our own systems (Vault for example) to load the passwords into environment variables on startup.

            Michael Russo added a comment - I would be happy if they officially supported setting these passwords via environment variables. That way, we can use our own systems (Vault for example) to load the passwords into environment variables on startup.

            Harry Tarnoff added a comment - - edited

            It would be good if all Atlassian server application codebases operated similarly in this regard since our AppSec review (as I imagine would be most others) is conditioned not on just one server but multiple - Jira, Confluence, and Crowd in our case. As of the moment, only the Jira server supports database password encryption.

            Harry Tarnoff added a comment - - edited It would be good if all Atlassian server application codebases operated similarly in this regard since our AppSec review (as I imagine would be most others) is conditioned not on just one server but multiple - Jira, Confluence, and Crowd in our case. As of the moment, only the Jira server supports database password encryption.

              e5b980069724 Rostyslav Shurukhin (Inactive)
              wwong Wayne Wong
              Votes:
              30 Vote for this issue
              Watchers:
              23 Start watching this issue

                Created:
                Updated:
                Resolved: