[HADOOP-15325] Make Configuration#getPasswordFromCredentialsProvider() a public API

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Implemented
• Affects Version/s: 2.6.0
• Component/s: conf
• Target Version/s: 3.2.0
• Assignee: Zsolt Venczel
• Reporter: Wei-Chiu Chuang
• Created: 19/Mar/18 16:46
• Updated: 02/Oct/19 17:16
• Resolved: 30/Mar/18 01:10

Description

HADOOP-10607 added a public API Configuration.getPassword() which reads passwords from credential provider and then falls back to reading from configuration if one is not available.

This API has been used throughout Hadoop codebase and downstream applications. It is understandable for old password configuration keys to fallback to configuration to maintain backward compatibility. But for new configuration passwords that don't have legacy, there should be an option to not fallback, because storing passwords in configuration is considered a bad security practice.

Issue Links

• blocks: HADOOP-15351 Deprecate all existing password fields in hadoop configuration
• blocks: HDFS-13366 Deprecate all existing password fields in hdfs configuration
• is related to: HADOOP-12862 LDAP Group Mapping over SSL can not specify trust store