[OOZIE-2771] Allow retrieving keystore and truststore passwords from Hadoop Credential Provider

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 5.0.0b1
• Assignee: Attila Sasvári
• Reporter: Attila Sasvári
• Created: 10/Jan/17 12:04
• Updated: 27/Jan/18 15:53
• Resolved: 25/Jan/17 06:56

Description

Right now passwords for keystore and truststore (oozie.https.keystore.pass, oozie.https.truststore.pass) are stored in oozie-site.xml as cleartext.

However, Oozie could take advantage of the Hadoop Credential Provider for storing and retrieving that passwords similarly how the JDBC password (oozie.service.JPAService.jdbc.password) is handled today (see https://issues.apache.org/jira/browse/OOZIE-2272).

This way keystore and truststore passwords could be masked in oozie-site.

Note: ConfigurationService.getPassword is worth to look at.