Skip to content

Commit

Permalink
PR review changes
Browse files Browse the repository at this point in the history
Signed-off-by: dhoard <doug.hoard@gmail.com>
  • Loading branch information
dhoard committed May 20, 2023
1 parent ba4c31e commit bfbae1b
Show file tree
Hide file tree
Showing 29 changed files with 679 additions and 213 deletions.
71 changes: 26 additions & 45 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -146,11 +146,19 @@ If a given part isn't set, it'll be excluded.
## HTTP Authentication (optional)
HTTP BASIC authentication it supported using various configuration formats.
HTTP BASIC authentication supports using the following configuration algorithms:
- plaintext - plaintext password
- SHA-1 - SHA-1(`<salt>:<password>`)
- SHA-256 - SHA-256(`<salt>:<password>`)
- SHA-512 - SHA-512(`<salt>:<password>`)
- PBKDF2WithHmacSHA1
- PBKDF2WithHmacSHA256
- PBKDF2WithHmacSHA512
---
Simple example (plaintext configuration value):
Plaintext example:
```yaml
httpServer:
Expand All @@ -162,73 +170,46 @@ httpServer:

---

More secure example (SHA-256 using a salted password `SHA256(<salt>:<password>)`):
SHA-256 example using a salted password SHA-256(`<salt>:<password>`) with a password of `secret`

```yaml
httpServer:
authentication:
basic:
username: Prometheus
hash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
passwordHash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
algorithm: SHA-256
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
```
**Notes**
- `algorithm` type must match a supported Java algorithm (JVM specific)

- `salt` is random string that you choose

---
Secure example (PBKDF2WithHmacSHA1):
PBKDF2WithHmacSHA256 example with a password of `secret`

```yaml
httpServer:
authentication:
basic:
username: Prometheus
password: B6:9C:5C:8A:10:3E:41:7B:BA:18:FC:E1:F2:0C:BC:D9:65:70:D3:53:AB:97:EE:2F:3F:A8:88:AF:43:EA:E6:D7:FB:70:14:23:F9:51:29:5C:3A:9F:65:C3:20:EE:09:C9:C6:8A:B7:D3:0A:E1:F3:10:2B:9B:36:3F:1F:B6:1D:52:A7:9C:CB:AD:55:25:46:C5:73:09:6C:38:9C:F2:FD:82:7F:90:E5:31:EF:7E:3E:6B:B2:0C:38:77:23:EC:3A:CF:29:F7:E5:4D:4E:CC:35:7A:C2:E5:CB:E3:B3:E5:09:2B:CC:B9:40:26:A4:28:E9:5F:2D:18:B2:14:41:E7:4D:5B
algorithm: PBKDF2WithHmacSHA256
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
passwordHash: A1:0E:4E:62:F7:1E:0B:59:0A:32:EA:CC:7C:65:37:1F:6D:A6:F1:F1:ED:3F:73:ED:C9:65:19:37:21:5B:6D:4E:9D:C6:61:DF:B5:BF:BB:16:B8:9A:50:14:57:CE:3D:14:67:73:A3:71:1B:87:3B:C4:B1:0E:DC:2D:0B:10:65:D6:F5:B6:DA:07:DD:EE:DA:AC:9C:60:CD:B4:59:0C:C9:CB:A7:3D:7E:30:3E:43:83:E9:E4:13:34:A1:F1:87:5C:24:46:8E:13:90:A6:66:E1:A6:F3:0B:5A:E7:14:8A:98:6A:81:2B:B6:F8:EF:95:D4:82:7E:FB:5E:2D:D3:24:FE:96
algorithm: `PBKDF2WithHmacSHA256`
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
```
**Notes**

- `algorithm` type must match a supported Java secret key algorithm (JVM specific)

- `salt` is random string that you choose

- `iterations` is the number of iterations to use

- `keyLength` is the key length to use
- iterations = `600000` (default value for PBKDF2WithHmacSHA256 )
- keyLength = `128` bits (default value)

- `hash` is the hash (as generated by `openssl`)

### Generating passwords

To generate a salted MessageDigest algorithm-based password, use the appropriate application for the algorithm

Example:

SHA-256 configuration hash generation

```
echo -n "98LeBWIjca:secret" | sha256sum
```
Example:
**Notes**

PBKDF2WithHmac256 configuration hash generation
- PBKDF2WithHmacSHA1 default iterations = `1300000`
- PBKDF2WithHmacSHA256 default iterations = `600000`
- PBKDF2WithHmacSHA256 default iterations = `210000`
- default keyLength = `128` (bits)

Example:
## Generation of `passwordHash`

```
openssl kdf -keylen 128 -kdfopt digest:SHA256 -kdfopt pass:secret -kdfopt salt:98LeBWIjca -kdfopt iter:1000 PBKDF2
```
- `sha1sum`, `sha256sum`, and `sha512sum` can be used to generate the `passwordHash`
- `openssl` can be used to generate a PBKDF2WithHmac based algorithm `passwordHash`

---

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 17:87:CA:B9:14:73:60:36:8B:20:82:87:92:58:43:B8:A3:85:66:BC:C1:6D:C3:31:6C:1D:47:48:C7:F2:E4:1D:96:00:11:F8:4D:94:63:2F:F2:7A:F0:3B:72:63:16:5D:EF:5C:97:CC:EC:59:CB:18:4A:AA:F5:23:63:0B:6E:3B:65:E0:72:6E:69:7D:EB:83:05:05:E5:D6:F2:19:99:49:3F:89:DA:DE:83:D7:2B:5B:7D:C9:56:B4:F2:F6:A5:61:29:29:ED:DF:4C:4E:8D:EA:DF:47:A2:B0:89:11:86:D4:77:A1:02:E9:0C:26:A4:1E:2A:C1:A8:71:E0:93:8F:A4
passwordHash: 26:40:93:17:BB:A0:82:68:1E:67:46:61:9F:02:1F:EC:B6:F8:34:FA:D8:7A:5B:DF:E1:36:A0:68:38:A5:6C:90:9A:C1:EC:29:90:34:75:F0:BD:96:C7:07:EE:4A:9A:7D:B2:AF:6D:49:7D:BB:8C:E1:CF:76:FF:1D:68:08:41:BE:38:73:76:6E:C6:0A:CB:2F:C0:71:CF:5E:F6:BB:AD:1A:E6:09:2E:C7:AF:04:BC:92:DB:D3:91:F0:27:5A:58:B2:FF:26:F2:24:E8:0B:CC:E5:8C:F6:81:81:AF:2D:D3:31:8F:E4:49:A7:0E:20:61:8A:5F:26:20:63:93:C6:64:B5
algorithm: PBKDF2WithHmacSHA1
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,9 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 17:87:CA:B9:14:73:60:36:8B:20:82:87:92:58:43:B8:A3:85:66:BC:C1:6D:C3:31:6C:1D:47:48:C7:F2:E4:1D:96:00:11:F8:4D:94:63:2F:F2:7A:F0:3B:72:63:16:5D:EF:5C:97:CC:EC:59:CB:18:4A:AA:F5:23:63:0B:6E:3B:65:E0:72:6E:69:7D:EB:83:05:05:E5:D6:F2:19:99:49:3F:89:DA:DE:83:D7:2B:5B:7D:C9:56:B4:F2:F6:A5:61:29:29:ED:DF:4C:4E:8D:EA:DF:47:A2:B0:89:11:86:D4:77:A1:02:E9:0C:26:A4:1E:2A:C1:A8:71:E0:93:8F:A4
passwordHash: 26:40:93:17:BB:A0:82:68:1E:67:46:61:9F:02:1F:EC:B6:F8:34:FA:D8:7A:5B:DF:E1:36:A0:68:38:A5:6C:90:9A:C1:EC:29:90:34:75:F0:BD:96:C7:07:EE:4A:9A:7D:B2:AF:6D:49:7D:BB:8C:E1:CF:76:FF:1D:68:08:41:BE:38:73:76:6E:C6:0A:CB:2F:C0:71:CF:5E:F6:BB:AD:1A:E6:09:2E:C7:AF:04:BC:92:DB:D3:91:F0:27:5A:58:B2:FF:26:F2:24:E8:0B:CC:E5:8C:F6:81:81:AF:2D:D3:31:8F:E4:49:A7:0E:20:61:8A:5F:26:20:63:93:C6:64:B5
algorithm: PBKDF2WithHmacSHA1
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
hostPort: application:9999
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: B6:9C:5C:8A:10:3E:41:7B:BA:18:FC:E1:F2:0C:BC:D9:65:70:D3:53:AB:97:EE:2F:3F:A8:88:AF:43:EA:E6:D7:FB:70:14:23:F9:51:29:5C:3A:9F:65:C3:20:EE:09:C9:C6:8A:B7:D3:0A:E1:F3:10:2B:9B:36:3F:1F:B6:1D:52:A7:9C:CB:AD:55:25:46:C5:73:09:6C:38:9C:F2:FD:82:7F:90:E5:31:EF:7E:3E:6B:B2:0C:38:77:23:EC:3A:CF:29:F7:E5:4D:4E:CC:35:7A:C2:E5:CB:E3:B3:E5:09:2B:CC:B9:40:26:A4:28:E9:5F:2D:18:B2:14:41:E7:4D:5B
passwordHash: 02:56:48:21:BA:EF:62:CC:92:79:90:C4:E6:45:F0:48:2E:C4:8D:60:12:E5:DC:32:CA:A9:21:5F:EB:AC:80:07:3B:13:8E:EA:BF:17:5A:EA:FD:C5:2E:15:96:45:1E:12:57:8D:D6:95:EC:B1:90:FC:54:BB:48:57:A8:D9:BB:E5:C3:11:B3:DD:F4:09:DB:15:8C:A9:4D:53:6B:7D:DD:02:41:B1:86:0F:A3:4F:B6:71:2F:9A:ED:90:77:47:7F:D7:33:B1:5A:B6:A9:1B:7F:BD:43:C7:22:51:3B:04:86:89:54:42:79:D4:4F:24:BE:47:06:47:CC:48:E3:AF:EE:45
algorithm: PBKDF2WithHmacSHA256
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,9 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: B6:9C:5C:8A:10:3E:41:7B:BA:18:FC:E1:F2:0C:BC:D9:65:70:D3:53:AB:97:EE:2F:3F:A8:88:AF:43:EA:E6:D7:FB:70:14:23:F9:51:29:5C:3A:9F:65:C3:20:EE:09:C9:C6:8A:B7:D3:0A:E1:F3:10:2B:9B:36:3F:1F:B6:1D:52:A7:9C:CB:AD:55:25:46:C5:73:09:6C:38:9C:F2:FD:82:7F:90:E5:31:EF:7E:3E:6B:B2:0C:38:77:23:EC:3A:CF:29:F7:E5:4D:4E:CC:35:7A:C2:E5:CB:E3:B3:E5:09:2B:CC:B9:40:26:A4:28:E9:5F:2D:18:B2:14:41:E7:4D:5B
passwordHash: 02:56:48:21:BA:EF:62:CC:92:79:90:C4:E6:45:F0:48:2E:C4:8D:60:12:E5:DC:32:CA:A9:21:5F:EB:AC:80:07:3B:13:8E:EA:BF:17:5A:EA:FD:C5:2E:15:96:45:1E:12:57:8D:D6:95:EC:B1:90:FC:54:BB:48:57:A8:D9:BB:E5:C3:11:B3:DD:F4:09:DB:15:8C:A9:4D:53:6B:7D:DD:02:41:B1:86:0F:A3:4F:B6:71:2F:9A:ED:90:77:47:7F:D7:33:B1:5A:B6:A9:1B:7F:BD:43:C7:22:51:3B:04:86:89:54:42:79:D4:4F:24:BE:47:06:47:CC:48:E3:AF:EE:45
algorithm: PBKDF2WithHmacSHA256
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
hostPort: application:9999
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 07:6F:E2:27:9B:CA:48:66:9B:13:9E:02:9C:AE:FC:E4:1A:2F:0F:E6:48:A3:FF:8E:D2:30:59:68:12:A6:29:34:FC:99:29:8A:98:65:AE:4B:05:7C:B6:83:A4:83:C0:32:E4:90:61:1D:DD:2E:53:17:01:FF:6A:64:48:B2:AA:22:DE:B3:BC:56:08:C6:66:EC:98:F8:96:8C:1B:DA:B2:F2:2A:6C:22:8E:19:CC:B2:62:55:3E:BE:DC:C7:58:36:9D:92:CF:D7:D2:A1:6D:8F:DC:DE:8E:E9:36:D4:E7:2D:0A:6D:A1:B8:56:0A:53:BB:17:E2:D5:DE:A0:48:51:FC:33
passwordHash: CA:7E:D3:B7:DB:D3:19:A3:D2:CE:7A:10:2A:F4:2F:3B:C8:75:33:A8:E5:77:6A:10:69:C7:5C:57:B3:F9:4C:EE:14:6F:9D:E2:03:4D:FC:DF:EF:A6:2D:8F:08:AE:A5:77:41:E6:47:C4:27:A7:8F:77:61:B5:BD:69:2E:08:7A:34:3F:27:B0:9C:04:EF:FD:B1:55:E5:CC:12:1C:0F:4A:D0:56:BA:DC:54:CA:36:DE:DB:00:66:8C:24:2D:C6:90:8E:57:36:D4:1D:4E:F2:F0:38:12:EA:1B:F4:43:91:8D:82:08:58:3A:7F:F2:3D:3E:6E:62:E2:FD:EB:A8:2A:01:AB
algorithm: PBKDF2WithHmacSHA512
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,11 +2,9 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 07:6F:E2:27:9B:CA:48:66:9B:13:9E:02:9C:AE:FC:E4:1A:2F:0F:E6:48:A3:FF:8E:D2:30:59:68:12:A6:29:34:FC:99:29:8A:98:65:AE:4B:05:7C:B6:83:A4:83:C0:32:E4:90:61:1D:DD:2E:53:17:01:FF:6A:64:48:B2:AA:22:DE:B3:BC:56:08:C6:66:EC:98:F8:96:8C:1B:DA:B2:F2:2A:6C:22:8E:19:CC:B2:62:55:3E:BE:DC:C7:58:36:9D:92:CF:D7:D2:A1:6D:8F:DC:DE:8E:E9:36:D4:E7:2D:0A:6D:A1:B8:56:0A:53:BB:17:E2:D5:DE:A0:48:51:FC:33
passwordHash: CA:7E:D3:B7:DB:D3:19:A3:D2:CE:7A:10:2A:F4:2F:3B:C8:75:33:A8:E5:77:6A:10:69:C7:5C:57:B3:F9:4C:EE:14:6F:9D:E2:03:4D:FC:DF:EF:A6:2D:8F:08:AE:A5:77:41:E6:47:C4:27:A7:8F:77:61:B5:BD:69:2E:08:7A:34:3F:27:B0:9C:04:EF:FD:B1:55:E5:CC:12:1C:0F:4A:D0:56:BA:DC:54:CA:36:DE:DB:00:66:8C:24:2D:C6:90:8E:57:36:D4:1D:4E:F2:F0:38:12:EA:1B:F4:43:91:8D:82:08:58:3A:7F:F2:3D:3E:6E:62:E2:FD:EB:A8:2A:01:AB
algorithm: PBKDF2WithHmacSHA512
salt: 98LeBWIjca
iterations: 1000
keyLength: 128
hostPort: application:9999
rules:
- pattern: ".*"
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: f43eab5fac834f683a1b9453d5e9cb356599c082
passwordHash: f43eab5fac834f683a1b9453d5e9cb356599c082
algorithm: SHA-1
salt: uv=//2NtFCUS{::tY9P.DCv_jzmPja#%
rules:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: f43eab5fac834f683a1b9453d5e9cb356599c082
passwordHash: f43eab5fac834f683a1b9453d5e9cb356599c082
algorithm: SHA-1
salt: uv=//2NtFCUS{::tY9P.DCv_jzmPja#%
hostPort: application:9999
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
passwordHash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
algorithm: SHA-256
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
rules:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
passwordHash: 2bf7ed4906ac065bde39f7508d6102a6cdd7153a929ea883ff6cd04442772c99
algorithm: SHA-256
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
hostPort: application:9999
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: b89cdce276481d2909f4937e7b2f1fd80c164be71fa106c2df929bcba520469bda8b164f4d7dd774efe362d74d635a26f9b2b38117f6d59634929c00dd2b2e83
passwordHash: b89cdce276481d2909f4937e7b2f1fd80c164be71fa106c2df929bcba520469bda8b164f4d7dd774efe362d74d635a26f9b2b38117f6d59634929c00dd2b2e83
algorithm: SHA-512
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
rules:
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -2,7 +2,7 @@ httpServer:
authentication:
basic:
username: Prometheus
hash: b89cdce276481d2909f4937e7b2f1fd80c164be71fa106c2df929bcba520469bda8b164f4d7dd774efe362d74d635a26f9b2b38117f6d59634929c00dd2b2e83
passwordHash: b89cdce276481d2909f4937e7b2f1fd80c164be71fa106c2df929bcba520469bda8b164f4d7dd774efe362d74d635a26f9b2b38117f6d59634929c00dd2b2e83
algorithm: SHA-512
salt: U9i%=N+m]#i9yvUV:bA/3n4X9JdPXf=n
hostPort: application:9999
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
* limitations under the License.
*/

package io.prometheus.jmx.common.util.function;
package io.prometheus.jmx.common.configuration;

import io.prometheus.jmx.common.util.Precondition;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,10 +14,10 @@
* limitations under the License.
*/

package io.prometheus.jmx.common.util.function;
package io.prometheus.jmx.common.configuration;

import io.prometheus.jmx.common.util.Precondition;
import io.prometheus.jmx.util.map.MapAccessor;
import io.prometheus.jmx.common.yaml.YamlMapAccessor;

import java.util.Map;
import java.util.function.Function;
Expand All @@ -28,7 +28,7 @@
* from the Supplier if there is a ClassCastException
*/
@SuppressWarnings("unchecked")
public class ConvertToMapAccessor implements Function<Object, MapAccessor> {
public class ConvertToMapAccessor implements Function<Object, YamlMapAccessor> {

private Supplier<? extends RuntimeException> supplier;

Expand All @@ -49,9 +49,9 @@ public ConvertToMapAccessor(Supplier<? extends RuntimeException> supplier) {
* @return the return value
*/
@Override
public MapAccessor apply(Object value) {
public YamlMapAccessor apply(Object value) {
try {
return new MapAccessor((Map<Object, Object>) value);
return new YamlMapAccessor((Map<Object, Object>) value);
} catch (ClassCastException e) {
throw supplier.get();
}
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
* limitations under the License.
*/

package io.prometheus.jmx.common.util.function;
package io.prometheus.jmx.common.configuration;

import io.prometheus.jmx.common.util.Precondition;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
* limitations under the License.
*/

package io.prometheus.jmx.common.util.function;
package io.prometheus.jmx.common.configuration;

import io.prometheus.jmx.common.util.Precondition;

Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
* limitations under the License.
*/

package io.prometheus.jmx.common.util.function;
package io.prometheus.jmx.common.configuration;

import io.prometheus.jmx.common.util.Precondition;

Expand Down
Loading

0 comments on commit bfbae1b

Please sign in to comment.