Require internal shared secret is set when authentication is enabled#11944
Merged
dain merged 1 commit intotrinodb:masterfrom Apr 16, 2022
Merged
Require internal shared secret is set when authentication is enabled#11944dain merged 1 commit intotrinodb:masterfrom
dain merged 1 commit intotrinodb:masterfrom
Conversation
dain
force-pushed
the
require-internal-secret
branch
from
18752e0 to
270f7ad
Compare
Member
It used to be an allowed configuration. Is it no longer so? |
Member
Author
You can still have HTTPS client/server and HTTP server/server, but you now must explicitly set the shared secret when authentication is installed (no defaults) |
electrum
approved these changes
Apr 14, 2022
Member
There was a problem hiding this comment.
Nit: don’t use “is” for Boolean fields, only for getters.
dain
force-pushed
the
require-internal-secret
branch
from
270f7ad to
03bfd1a
Compare
kokosing
reviewed
Apr 25, 2022
| @@ -13,6 +13,7 @@ | |||
| */ | |||
Member
There was a problem hiding this comment.
Should we update docs that this is now required?
CC: @mosabua
nmahadevuni
added a commit
to nmahadevuni/presto
that referenced
this pull request
Jun 16, 2023
Supports JWT for authentication of internal requests. This is required for secure internal communication, especially when used in conjunction with external user authentication such as PASSWORD, LDAP etc Cherry-pick of trinodb/trino#2032 Cherry-pick of trinodb/trino#2090 Cherry-pick of trinodb/trino#2093 Cherry-pick of trinodb/trino#2202 Cherry-pick of trinodb/trino#11944 Co-authored-by: Dain Sundstrom <dain@iq80.com>
tdcmeehan
pushed a commit
to prestodb/presto
that referenced
this pull request
Jun 22, 2023
Supports JWT for authentication of internal requests. This is required for secure internal communication, especially when used in conjunction with external user authentication such as PASSWORD, LDAP etc Cherry-pick of trinodb/trino#2032 Cherry-pick of trinodb/trino#2090 Cherry-pick of trinodb/trino#2093 Cherry-pick of trinodb/trino#2202 Cherry-pick of trinodb/trino#11944 Co-authored-by: Dain Sundstrom <dain@iq80.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Require internal shared secret is set when authentication is enabled. This prevents configuration errors where the client to server interface is secured, but the server to server interface is not.
Documentation
( ) No documentation is needed.
( ) Sufficient documentation is included in this PR.
( ) Documentation PR is available with #prnumber.
(X) Documentation issue #issuenumber is filed, and can be handled later.
The existing security documentation will need to be updated to note that the secret is required when configuring authentication. There are many pages with instructions for setting up authentication and it is not clear where this note should go.
Release notes
( ) No release notes entries required.
(X) Release notes entries required with the following suggested text: