search

ansible-middleware / amq

A collection to manage AMQ brokers
Apache License 2.0
13 stars 11 forks source link

Add custom codec configurations for masked passwords #95

Closed guidograzioli closed 10 months ago

guidograzioli commented 10 months ago

Allow to configure password codec for masked password in JAAS property base files (artemis-users.properties) and broker.xml using a custom java class, by specifying the hash name and number of iterations (Default codec comes with hardcoded 'sha1' and 1024).

New parameters:

Variable Description Default
activemq_password_codec Fully qualified class name and its parameters for the Decoder used to decode the masked password. Ignored if activemq_mask_password is false. Can be postfixed with parameters in the key=value;... format org.apache.activemq.artemis.utils.DefaultSensitiveStringCodec
activemq_mask_password Whether passwords in server configuration need to be masked. True
activemq_additional_libs List of jars to install in activemq classpath, read from playbook files lookup paths []
activemq_mask_password_hashname Name of algorithm used for masking password, will be passed to custom codec sha1
activemq_mask_password_iterations Number of iterations for masking password, will be passed to custom codec 1024

Choices for activemq_mask_password_hashname are: [ 'sha1', 'sha224', 'sha256', 'sha384', 'sha512' ]

NOTE This feature won't work without providing a custom password codec class packaged in jar format. See Implementing Custom Codes. The custom codec class used in tests is here for reference.

NOTE The full feature can only work with activemq 2.29.0+ (AMQ Broker 7.11.1+) because of ARTEMIS-4273, https://github.com/apache/activemq-artemis/pull/4469

For a complete usage example, check the molecule test

Fix: #77