public/grafana
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Security: Store datasource passwords encrypted in secureJsonData (#16175)

Browse Source 
* Store passwords in secureJsonData

* Revert unnecessary refactors

* Fix for nil jsonSecureData value

* Remove copied encryption code from migration

* Fix wrong field reference

* Remove migration and provisioning changes

* Use password getters in datasource proxy

* Refactor password handling in datasource configs

* Add provisioning warnings

* Update documentation

* Remove migration command, moved to separate PR

* Remove unused code

* Set the upgrade version

* Remove unused code

* Remove double reference
This commit is contained in:
Andrej Ocenas
2019-04-15 11:11:17 +02:00
committed by GitHub
parent 844ec82eb0
commit 66f6e16916
30 changed files with 352 additions and 85 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/sources/installation/upgrading.md
+12 -1
View File
@@ -123,7 +123,18 @@ If you're using systemd and have a large amount of annotations consider temporar
If you have text panels with script tags they will no longer work due to a new setting that per default disallow unsanitized HTML.
Read more [here](/installation/configuration/#disable-sanitize-html) about this new setting.
### Authentication and security
## Upgrading to v6.2
Datasources store passwords and basic auth passwords in secureJsonData encrypted by default. Existing datasource
will keep working with unencrypted passwords. If you want to migrate to encrypted storage for your existing datasources
you can do that by:
- For datasources created through UI, you need to go to datasource config, re enter the password or basic auth
password and save the datasource.
- For datasources created by provisioning, you need to update your config file and use secureJsonData.password or
secureJsonData.basicAuthPassword field. See [provisioning docs](/administration/provisioning) for example of current
configuration.
## Authentication and security
If your using Grafana's builtin, LDAP (without Auth Proxy) or OAuth authentication all users will be required to login upon the next visit after the upgrade.