Uploaded image for project: 'Apache Fineract'
  1. Apache Fineract
  2. FINERACT-1653

Security Threat Cannot boot Apache Fineract if database is not on local host and password is not the default

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Resolved
    • Major
    • Resolution: Not A Problem
    • 1.7.0
    • 1.0.0, 1.1.0, 1.2.0, 1.3.0, 1.4.0, 1.5.0, 1.6.0
    • None
    • None

    Description

      As a user, i would like to setup apache fineract in a live production where the database server is separate from the ui server with a different root password from usual. 

      In the latest release, 1.7.0, there is a pre-compiled jar by the names of fineract-provider-1.5.1-0d5bace3-plain.jar which is used during boot up of Apache-Fineract. 

      As such, the user gets an error shown below ( amongst others )

      Error creating bean with name '(inner bean)#10ee8a73':

      Cannot resolve reference to bean 'entityManagerFactory' while setting constructor argument; nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'tenantDatabaseUpgradeService' defined in URL [jar:file:/usr/share/tomcat9/webapps/fineract-provider/WEB-INF/lib/fineract-provider-1.5.1-0d5bace3-plain.jar!

      /org/apache/fineract/infrastructure/core/service/migration/TenantDatabaseUpgradeService.class]: Unsatisfied dependency expressed through constructor parameter 0;

      nested exception is org.springframework.beans.factory.UnsatisfiedDependencyException: Error creating bean with name 'jdbcTenantDetailsService'

      defined in URL [jar:file:/usr/share/tomcat9/webapps/fineract-provider/WEB-INF/lib/fineract-provider-1.5.1-0d5bace3-plain.jar!

      this means users will not be able to deploy Mifos without using the default root password and if they have the database and ui on different servers. 

      IN release 1.6.0, tomcat deployment users had the opportunity to edit the following files after a first boot up when the war file is deployed (

      ......webapps/fineract-provider/WEB-INF/classes/META-INF/spring/jdbc.properties
      .....webapps/fineract-provider/WEB-INF/classes/META-INF/spring/hikariDataSource.xml 

      Attachments

        Activity

          People

            francisguchie Francis Guchie
            francisguchie Francis Guchie
            Votes:
            2 Vote for this issue
            Watchers:
            5 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: