Uploaded image for project: 'Nuxeo Platform'
  1. Nuxeo Platform
  2. NXP-24884

Email notification service must support encrypted parameters

    XMLWordPrintable

    Details

    • Type: Bug
    • Status: Resolved
    • Priority: Major
    • Resolution: Fixed
    • Affects Version/s: 9.10, 10.1
    • Fix Version/s: 9.10-HF07, 10.2
    • Component/s: Core, Notifications
    • Release Notes Summary:
      The support for encrypted parameters is added to the notification service.
    • Tags:
    • Backlog priority:
      800
    • Sprint:
      nxfit 10.2.4
    • Story Points:
      3

      Description

      Working scenario (authenticated SMTP traffic but unencrypted parameter mail.transport.password)

      1. install nuxeo
      2. add the following parameters to nuxeo.conf:
        mail.transport.port=2525
        mail.transport.user=toto
        mail.transport.password=password
        mail.transport.auth=true
        
      3. uncomment the following line in nuxeo.conf to allow debugging
        JAVA_OPTS=$JAVA_OPTS -Xdebug -Xrunjdwp:transport=dt_socket,address=8787,server=y,suspend=n
        
      4. start the server
      5. start a python debug server on port 2525:
        sudo python -m smtpd -n -c DebuggingServer localhost:2525
      6. login as Administrator
      7. create a workspace
      8. create a document in the workspace
      9. go the Administration tab
      10. start a debugging session in your preferred IDE
      11. set a breakpoint in EmailHelper on this line:
        https://github.com/nuxeo/nuxeo/blob/release-9.10-HF05/nuxeo-features/nuxeo-platform-notification/nuxeo-platform-notification-core/src/main/java/org/nuxeo/ecm/platform/ec/notification/email/EmailHelper.java#L111
      12. in the Notifications sub-tab register the Administrator user on New comment event.
      13. the breakpoint should be enabled right after
      14. in the variables, check the content of session.authenticator.properties and observe:
        mail.smtp.password=password
      15. stop the debugging session
      16. stop the server

      Non-working scenario (authenticated SMTP traffic but encrypted parameter mail.transport.password)

      1. encrypt the password with the following commands:
        nuxeoctl config server.crypt.secretkey --set -q
        nuxeoctl config mail.transport.password --encrypt --set -q
        
      2. when prompted set the password as password
      3. to double-check the encrypted password is decryptable use the following:
        nuxeoctl decrypt 'encryption string'
        
      4. start the server
      5. login as Administrator
      6. create a document in the workspace
      7. go the Administration tab
      8. start a debugging session in your preferred IDE
      9. set a breakpoint in EmailHelper on this line:
        https://github.com/nuxeo/nuxeo/blob/release-9.10-HF05/nuxeo-features/nuxeo-platform-notification/nuxeo-platform-notification-core/src/main/java/org/nuxeo/ecm/platform/ec/notification/email/EmailHelper.java#L111
      10. in the Notifications sub-tab register the Administrator user on New comment event.
      11. the breakpoint should be enabled right after
      12. in the variables, check the content of session.authenticator.properties and observe:
        mail.smtp.password=${mail.transport.password}

      Impact: this prevents using authentication to a mail server. It works fine when not encrypting the parameter. For instance, this means notifications cannot be sent in this case.

      Expected behavior: the parameter should be correctly decrypted.

        Attachments

          Issue Links

            Activity

              People

              • Votes:
                0 Vote for this issue
                Watchers:
                3 Start watching this issue

                Dates

                • Created:
                  Updated:
                  Resolved:

                  Time Tracking

                  Estimated:
                  Original Estimate - Not Specified
                  Not Specified
                  Remaining:
                  Remaining Estimate - 0 minutes
                  0m
                  Logged:
                  Time Spent - 1 day, 3 hours
                  1d 3h