<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
Hello,<br>
<br>
I would like to have your opinion about how to deal with passwords
in Tuskar-API<br>
<br>
The background is, that tuskarAPI is storing heat template
parameters in its database, it's a <br>
preparation for more complex workflows, when we will need to store
the data before the actual <br>
heat stack-create.<br>
<br>
So right now, the state is unacceptable, we are storing sensitive
data(all the heat passwords and keys)<br>
in a raw form in the TuskarAPI database. That is wrong right?<br>
<br>
So is anybody aware of the reasons, why we would need to store the
passwords? Storing them <br>
for a small amount of time (rather in a session) should be fine, so
we can use them for latter init of the stack.<br>
Do we need to store them for heat stack-update? Cause heat throws
them away.<br>
<br>
If yes, this bug should change to encrypting of the all sensitive
data, right? Cause it might be just me,<br>
but dealing with sensitive data like this the 8th deadly sin.<br>
<br>
The second thing is, if users will update their passwords, info in
the TuskarAPI will be obsolete and<br>
can't be used anyway.<br>
<br>
There is a bug filled for it:<br>
<a href="https://bugs.launchpad.net/tuskar/+bug/1282066">https://bugs.launchpad.net/tuskar/+bug/1282066</a><br>
<br>
Thanks for the feedback, seems like the bug is not as
straightforward as I thought.<br>
<br>
Kind Regards,<br>
Ladislav<br>
</body>
</html>