apache / apache/pulsar

should we allow users use clear password in AuthenticationProviderBasic

Open
#11,773 2 comments 0 reactions 0 assignees View on GitHub
lifecycle/stale type/enhancement
Dominant language
Java
Stars
15.3k
Forks
3.8k
Avg merge
1d 14h
Merged PRs (30d)
160

Description

**Is your enhancement request related to a problem? Please describe.**
now AuthenticationProviderBasic only support apr1 and crypt.

**Describe the solution you'd like**

maybe we can allow users use clear password , just like `password` not encrypt(password)

**Describe alternatives you've considered**

will match the original password first. if not match ,we check apr1 , then check crypt etc

**Additional context**
Add any other context or screenshots about the feature request here.

https://github.com/apache/pulsar/issues/11757#issuecomment-905265025

Contributor guide

Open the contributing guide

Research direction

Locate the AuthenticationProviderBasic entry point and review how it currently verifies apr1 and crypt passwords. Read the linked issue comment for context, then clarify the compatibility and security requirements for clear-password matching; done requires an agreed matching order and tests covering the supported formats.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
authentication, backend, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.