apache / apache/druid

Adding CredentialsProvider, deprecating PasswordProvider

Open
#9,351 13 comments 0 reactions 0 assignees View on GitHub
Design Review Proposal
Dominant language
Java
Stars
14.1k
Forks
3.8k
Avg merge
2d 58m
Merged PRs (30d)
233

Description

### Motivation

We are using `PasswordProvider` to secure user passwords in various places. However, it doesn't secure the user name (or account whatever).

### Proposed changes

This proposal is to add a new class `CredentialsProvider`. Similar to `PasswordProvider`, the `CredentialsProvider` provides various ways to get the user credential, but both user name and password.

```java
public interface CredentialsProvider
{
Map getCredentials();
}
```

### Rationale

Since the `PasswordProvider` has one method of `getPassword()`, we are already using two different `PasswordProvider`s to secure both user name and password in some places. `AWSCredentialsConfig` is an example:

```java
public class AWSCredentialsConfig
{
@JsonProperty
private PasswordProvider accessKey = new DefaultPasswordProvider("");

@JsonProperty
private PasswordProvider secretKey = new DefaultPasswordProvider("");
...
```

This is not good for user experience because they generally prefer to secure their account and password in the same way.

### Operational impact

The `PasswordProvider` will be deprecated in favor of the new `CredentialsProvider`. This would deprecate some configurations as well, but they will be still supported in a couple of next releases.

Contributor guide

Open the contributing guide

Research direction

Start by locating PasswordProvider, DefaultPasswordProvider, and AWSCredentialsConfig, then review the existing credential-related configurations and their tests. Done means adding the proposed CredentialsProvider interface, supporting both user name and password retrieval, and deprecating PasswordProvider and affected configurations while preserving their stated transitional support.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.