[AMBARI-12227] Kerberos Wizard: temporarily stores admin principal / password in browser's local storage

• Type: Bug
• Status: Resolved
• Priority: Critical
• Resolution: Fixed
• Affects Version/s: 2.0.0
• Fix Version/s: 2.1.1
• Component/s: ambari-web
• Assignee: Richard Zang
• Reporter: Richard Zang
• Created: 30/Jun/15 22:24
• Updated: 21/Jul/15 22:42
• Resolved: 21/Jul/15 19:40

Description

Kerberos admin credentials are stored in the browser's local storage in plain text during Enable Kerberos Wizard. This is blown away when the user exits the wizard or on log out.
However, if there is a chance for an attacker without proper Ambari credentials to look at the Kerberos credentials. For example, the admin can launch Enable Kerberos Wizard and enters Kerberos admin credentials on the 2nd page, and goes forward. At this point, Kerberos admin crendentials are stored in browser's local storage. If the user walks away from his desk, the other user can look in the browser developer tools to find the Kerberos admin principal and password.

Issue Links

• links to: Review Board