Skip to:

  1. Skip to Jira Navigation
  2. Skip to Side Navigation
  3. Skip to Main Content

DB details not encrypted in database

Description

Steps to reproduce

  1. Install a fresh Openfire 4.2.2 setup to a blank database

  2. Check the values of database.defaultProvider.username, database.defaultProvider.password

Expected results

  • The database username and password is encrypted in both the conf/openfire.xml file and in the matching entry in the ofprivate table.

Actual results

  • The database username and password is encrypted in the conf/openfire.xml file, but  in plain text in the ofprivate table.

Workaround

  • Manually encrypt the properties using the "+" button in the admin GUI.

Environment

None

Activity

Show:

Greg Thomas July 2, 2018 at 9:37 AM

Re-opened due to query @ https://github.com/igniterealtime/Openfire/pull/1060#issuecomment-401370818 

I've double checked my tests, and re-closing as I now believe it's all working OK.

Greg Thomas April 11, 2018 at 2:02 PM

NB. I'm surprised that the encrypted form of the database credentials differ between the conf/openfire.xml and database, but things still appear to work regardless.

Greg Thomas March 9, 2018 at 1:43 PM

Note 2; also affects ldap.adminDN, ldap.adminPassword settings.

Greg Thomas March 9, 2018 at 11:33 AM

Note; the workaround ends up with a different (encrypted) value in the database than in the openfire.xml file - the latter is left untouched by the manual encryption process, hence this step doesn't affect functionality.

Fixed

Details

Created March 9, 2018 at 11:30 AM
Updated October 28, 2020 at 1:26 PM
Resolved July 2, 2018 at 9:37 AM

Flag notifications