[JCLOUDS-933] username & password are displayed in logs in case of authentication or invalid host errors

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Duplicate
• Affects Version/s: 1.8.1
• Component/s: jclouds-core
• Labels: authentication logging security
• Flags: Important
• Assignee: Unassigned
• Reporter: Alexei Yarilovets
• Created: 11/Jun/15 12:58
• Updated: 11/Jun/15 13:32
• Resolved: 11/Jun/15 13:31

Description

Try to connect to unknown host, will get username & password printed in logs.
For example:
2015-06-02 16:43:23,743 ERROR [t-main] [BackoffLimitedRetryHandler] - Cannot retry after server error, command has exceeded retry limit 0: [method=org.jclouds.openstack.keystone.v2_0.AuthenticationApi.public abstract org.jclouds.openstack.keystone.v2_0.domain.Access org.jclouds.openstack.keystone.v2_0.AuthenticationApi.authenticateWithTenantNameAndCredentials(java.lang.String,org.jclouds.openstack.keystone.v2_0.domain.PasswordCredentials)[null, PasswordCredentials

{username=a, password=z}

], request=POST HTTP://1.1.1.1:5000/v2.0/tokens HTTP/1.1]

Issue Links

• duplicates: JCLOUDS-823 BackoffLimitedRetryHandler prints username and password involved in request