Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Hash passwords for the local-file auth provider #5

Open
mountaindude opened this issue Jan 22, 2021 · 0 comments
Open

Hash passwords for the local-file auth provider #5

mountaindude opened this issue Jan 22, 2021 · 0 comments

Comments

@mountaindude
Copy link
Contributor

Is your feature request related to a problem? Please describe.
As of v1.0.0 the passwords for the local-file auth provider are stored in clear text in a YAML file on disk.

This is not good at all from a security point of view.
Better would be to store a hashed and salted version of the passwords in the YAML file.

Describe the solution you'd like
Add an option to the local-file auth provider in the main YAML config file.
Something like:

localFile:                          # "Local file" provider reads user data from a file on disk
    enable: false
    hashPassword: true
    url: https://<FQDN>:8081        # URL where login UI for this provider is available
    userDirectory: lab              # Qlik Sense user directory that will be used for the authenticated user
    userFile: ./config/users.yaml   # YAML file containing usernames and passwords

The default (if the hashPassword field is not specified) would be to require hashed passwords.
If someone really don't want hashed passwords they can set the field to false.

NOTE: This would be a breaking change as the default as of version 1.0 is that passwords are NOT hashed.

Use an established, proven hashing library instead of inventing something new.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant