search

ambitus / pyracf

Python interface to the RACF Command interface.
https://ambitus.github.io/pyracf/
Apache License 2.0
10 stars 4 forks source link

Secrets redaction #9

Closed ElijahSwiftIBM closed 1 year ago

ElijahSwiftIBM commented 1 year ago

:bulb: Issue Reference

Issue: #6

:computer: What does this address?

Leverages existing IRRSMO00 functionality to better redact passwords, password phrases and other fields. Also better cleans up references to secrets in the python code, and allows for adding to the list of redacted secrets (password and password phrase). Also adds UserAdmin.set_passphrase function.

:pager: Implementation Details

Changed options to always include option 8 in IRRSMO00. Drop references to parameter lists and strings containing input information when no longer used. Redact using regex rather than character replacement.

:clipboard: Is there a test case?

Added a test case and made adjustments to existing test case suite for password and password phrase redaction

Either include the path to the test case file, or details on a manual test

lcarcaramo commented 1 year ago

One other thing to note is that now that IRRSMO00 handles redacting sensitive data from results, the password and passphrase redaction tests are actually now redundant. We only really need to verify that all secrets in debug logging are redacted and that request xml returned when using generate_requests_only is redacted. One thing that might be good to validate though is the clear state functionality if possible. Either way, I think we can get rid of the password and passphrase redaction tests in test_user_result_parser.py along with corresponding constants and xml samples since they don't really test anything anymore. Again, also note that anything that redacts results in logger.py is also now unnecessary since irrsmo00 handles redacting results for us as I have noted in feedback I provided earlier.

ElijahSwiftIBM commented 1 year ago

One other thing to note is that now that IRRSMO00 handles redacting sensitive data from results, the password and passphrase redaction tests are actually now redundant. We only really need to verify that all secrets in debug logging are redacted and that request xml returned when using generate_requests_only is redacted. One thing that might be good to validate though is the clear state functionality if possible. Either way, I think we can get rid of the password and passphrase redaction tests in test_user_result_parser.py along with corresponding constants and xml samples since they don't really test anything anymore. Again, also note that anything that redacts results in logger.py is also now unnecessary since irrsmo00 handles redacting results for us as I have noted in feedback I provided earlier.

I would like to keep the redaction tests as they serve as validation of the redaction of the result xml. While we now rely on IRRSMO00's redaction somewhat, ours is a bit more comprehensive, and testing us allows to ensure that this functionality persists with future releases.