[Geoserver-users] Encrypting password in Geoserver

GeoServer GeoServer User
1

Hi,

I want to know if there is encryption methodology implemented for
(Catalog.xml file) <connectionParams> <parameter name = "passwd" value =
"XXXXX" /> in any of Geoserver version.

I am using Geoserver 1.6.3 and I found that password is not being encrypted.
I tried to add patch to the Geoserver 1.6.3 based on this link (
http://jira.codehaus.org/browse/GEOS-1793?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel)
But Maven build failed as shown in this link
(http://jira.codehaus.org/browse/GEOS-1917)

I again installed Geoserver 1.7.0 and checked ConnectionParameter tag in
Catalog.xml file. I found that password is not being encrypted even in
version 1.7.0. Is there any way to get the password encrypted.

thanks in advance.

--
View this message in context: http://www.nabble.com/Encrypting-password-in-Geoserver-tp21352022p21352022.html
Sent from the GeoServer - User mailing list archive at Nabble.com.

2

Hi,

Unfortunately this a feature we don't quite support. There is already a feature request open for this:

http://jira.codehaus.org/browse/GEOS-1793

It seems there is a patch attached to the issue but has yet to be applied. This issue is currently scheduled for 1.7.3 (not next release but the release after).

Andrea: do you think its work moving up to 1.7.2?

AZGHAR wrote:

Hi,

I want to know if there is encryption methodology implemented for
(Catalog.xml file) <connectionParams> <parameter name = "passwd" value =
"XXXXX" /> in any of Geoserver version.

I am using Geoserver 1.6.3 and I found that password is not being encrypted. I tried to add patch to the Geoserver 1.6.3 based on this link ( http://jira.codehaus.org/browse/GEOS-1793?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel)
But Maven build failed as shown in this link
(http://jira.codehaus.org/browse/GEOS-1917)

I again installed Geoserver 1.7.0 and checked ConnectionParameter tag in
Catalog.xml file. I found that password is not being encrypted even in
version 1.7.0. Is there any way to get the password encrypted.

thanks in advance.

--
Justin Deoliveira
OpenGeo - http://opengeo.org
Enterprise support for open source geospatial.

3

Justin Deoliveira ha scritto:

Hi,

Unfortunately this a feature we don't quite support. There is already a feature request open for this:

http://jira.codehaus.org/browse/GEOS-1793

It seems there is a patch attached to the issue but has yet to be applied. This issue is currently scheduled for 1.7.3 (not next release but the release after).

Andrea: do you think its work moving up to 1.7.2?

I would need to investigate that more. For example one thing that's obviously missing in that patch is support for being backwards
compatible: we need a flag (maybe more than one, what about the security
user's file?) to tell if the passwords are encrypted or not.

The other detail I'm not totally psyched about is that even this
way the administrator will know the passwords of the users, whilst
in a proper security setup the admin should not. He should be able
to change the passwords of other users, but not be able to know them.
But then again, this requires a UI for registering and managing
each user profile, something I'm definitely looking forward to
implement once the new UI is in place.

Anyways, as an intermediate step, I can be persuaded to implement
this in time for 1.7.2. I think we have to double check with the
other devs, but it should be doable.

Cheers
Andrea

--
Andrea Aime
OpenGeo - http://opengeo.org
Expert service straight from the developers.