eclipse-edc / eclipse-edc/Connector

secret is not put in the `TransferRequestMessage` (for legacy signaling flows)

Open
#5,753 1 comment 0 reactions 0 assignees View on GitHub
bug wontfix
Dominant language
Java
Stars
424
Forks
300
Avg merge
12h 45m
Merged PRs (30d)
34

Description

# Bug Report

## Describe the Bug

Currently the `VaultDataAddressStore` is reading a "secret" from the vault (based on the keyName) and puts it in the DataAddress when a `TransferRequestMessage` needs to be dispatched:
https://github.com/eclipse-edc/Connector/blob/64cadb7cfc452d7f26ac57298253f1225c5969a4/core/control-plane/control-plane-transfer/src/main/java/org/eclipse/edc/connector/controlplane/transfer/dataaddress/VaultDataAddressStore.java#L118-L122

problem is that this happens only when the address is not stored in the vault, so, for new transfers, "never", so potentially all the PUSH transfers could be broken since version 0.16.0 (verified in downstream project `mds-edc`: [PR](https://github.com/Mobility-Data-Space/mds-edc/pull/434)).

note that this fix is necessary only for legacy signaling data flow, with the new DPS the `DataAddress` is completely managed by the DataPlane and it will already bring the related secrets with it.

### Expected Behavior

if "keyName" is set, the secret is fetched from the vault in any case.

## Context Information

- EDC 0.16.0
- current main as well

## Possible implementation
when a `DataAddress` is stored, if it contains the `keyName` property, look up for the secret in the vault, if it exists, put it in the `DataAddress` and remove the `keyName`, then store the `DataAddress` in the vault.

This way, the secrets will always be stored together with the `DataAddress` securely in the `vault`

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.