apache
[WIP] Proof of concept for a generic password provider
One of the main security concerns regarding Flume is that currently passwords can only be set in plain text in the config file. I have a proof-of-concept to overcome this limitation with an extensible password provider.
The core of the solution is the PasswordProvider interface which has a default implementation (PlainTextPasswordProvider) which returns the value of the given key, thus taking care of backwards compatibility.
The other implementation is the ExternalProcessPasswordProvider which executes the configured command and returns its output.
Usage example can be seen in the AvroSource (see the 2nd commit of this PR):
- keystorePassword = context.getString(KEYSTORE_PASSWORD_KEY);
+ keystorePassword = PasswordConfigurator.getPassword(context, KEYSTORE_PASSWORD_KEY);
Example configuration to use the ExternalProcessPasswordProvider:
...
a.sources.avro.keystore-password.passwordProviderClass=org.apache.flume.conf.ExternalProcessPasswordProvider
a.sources.avro.keystore-password.command=get_avro_keystore_password.sh
...
Example configuration with no passwordProviderClass set:
...
a.sources.avro.keystore-password=SecretPassword
...
As no passwordProviderClass is set in this example the default PlainTextPasswordProvider is used which returns the value of a.sources.avro.keystore-password.
Note: this is still a work in progress, I wanted to sketch up my idea. Any questions/comments/suggestions are more than welcome.
I didn't look at this much yet, but would this ultimately be compatible with standard JAAS credential providers, like the one Hadoop implements?
