Uploaded image for project: 'Directory ApacheDS'
  1. Directory ApacheDS
  2. DIRSERVER-1088

Do not cache plain text passwords in credential cache or in LdapPrincipal

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 1.5.0, 1.5.1
    • 1.5.4
    • core
    • None

    Description

      It's really not a good idea to cache plain text passwords in memory which can easily be comprimised with memory readers to enable password theft. The best thing to do here in the short term is to disable caching if the password is plaintext.

      If caching is still desired then a temp key generated at startup can be used to encrypt and decrypt plain text password when put into memory. Perhaps this is the best option which still keeps performance.

      Attachments

        Activity

          People

            elecharny Emmanuel Lécharny
            akarasulu Alex Karasulu
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: