wagon-webdav does not ask for auth password when <username>...</username> is missing

Details

  • Type: Improvement Improvement
  • Status: Closed Closed
  • Priority: Major Major
  • Resolution: Won't Fix
  • Affects Version/s: 1.0-beta-1
  • Fix Version/s: None
  • Component/s: wagon-webdav
  • Labels:
    None
  • Environment:
    Linux and Windows

Description

We use as internal repository a WebDav server with BASIC authentication. Only internal developers have access to this WebDav server and so e.g. internship students do not have access to company jars.

Now when the server definition in settings.xml does not contain the <username>...</username> element, then wagon-webdav should ask once for the missing password on the command line. Right now it just fails.

Issue Links

is related to

Improvement - An improvement or enhancement to an existing feature or task. MDEPLOY-51 Prompt for username and password if not supplied

  • Major - Major loss of function.
  • Open - The issue is open and ready for the assignee to start work on it.
relates to

New Feature - A new feature of the product, which has yet to be developed. MNG-553 Secure Storage of Server Passwords

  • Critical - Crashes, loss of data, severe memory leak.
  • Closed - The issue is considered finished, the resolution is correct. Issues which are not closed can be reopened.

Activity

Ascending order - Click to sort in descending order
Hide
Permalink
Carlos Sanchez added a comment -

None of the wagons do that. In any case requires a change in the way it works

Show
Carlos Sanchez added a comment - None of the wagons do that. In any case requires a change in the way it works
Hide
Permalink
Joe Cool added a comment -

Hmm IMHO this is a serious security issue. I do not want to store my password unencrypted in a text file.

Show
Joe Cool added a comment - Hmm IMHO this is a serious security issue. I do not want to store my password unencrypted in a text file.
Hide
Permalink
Carlos Sanchez added a comment -

Then that's a different issue, see MNG-553

Show
Carlos Sanchez added a comment - Then that's a different issue, see MNG-553
Hide
Permalink
galmeida added a comment -

Even storing encrypted password is considered insecure by some organizations/individuals, wagons should really ask for passwords when they can not be found in settings.xml (or other more secure store)

Show
galmeida added a comment - Even storing encrypted password is considered insecure by some organizations/individuals, wagons should really ask for passwords when they can not be found in settings.xml (or other more secure store)
Hide
Permalink
Brett Porter added a comment -

this needs to be addressed in Maven, not in Wagon

Show
Brett Porter added a comment - this needs to be addressed in Maven, not in Wagon
Hide
Permalink
Joe Cool added a comment -

@Brett: did you open an issue/event for Maven regarding this problem? If yes please add the URL here; if no please start such an vent.

Regards && thanks!

Show
Joe Cool added a comment - @Brett: did you open an issue/event for Maven regarding this problem? If yes please add the URL here; if no please start such an vent. Regards && thanks!
Hide
Permalink
Brett Porter added a comment -

MNG-553 covers the alternative of prompting for passwords

Show
Brett Porter added a comment - MNG-553 covers the alternative of prompting for passwords

People

  • Assignee:
    Brett Porter
    Reporter:
    Joe Cool
Vote (3)
Watch (1)

Dates

  • Created:
    Updated:
    Resolved: