{"action":"opened","issue":{"url":"https://api.github.com/repos/spring-cloud/spring-cloud-config/issues/85","labels_url":"https://api.github.com/repos/spring-cloud/spring-cloud-config/issues/85/labels{/name}","comments_url":"https://api.github.com/repos/spring-cloud/spring-cloud-config/issues/85/comments","events_url":"https://api.github.com/repos/spring-cloud/spring-cloud-config/issues/85/events","html_url":"https://github.com/spring-cloud/spring-cloud-config/issues/85","id":57650721,"number":85,"title":"Config Server Client Security","user":{"login":"iceycake","id":350468,"avatar_url":"https://avatars.githubusercontent.com/u/350468?v=3","gravatar_id":"","url":"https://api.github.com/users/iceycake","html_url":"https://github.com/iceycake","followers_url":"https://api.github.com/users/iceycake/followers","following_url":"https://api.github.com/users/iceycake/following{/other_user}","gists_url":"https://api.github.com/users/iceycake/gists{/gist_id}","starred_url":"https://api.github.com/users/iceycake/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/iceycake/subscriptions","organizations_url":"https://api.github.com/users/iceycake/orgs","repos_url":"https://api.github.com/users/iceycake/repos","events_url":"https://api.github.com/users/iceycake/events{/privacy}","received_events_url":"https://api.github.com/users/iceycake/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-02-13T20:36:23Z","updated_at":"2015-02-13T20:36:23Z","closed_at":null,"body":"I have briefly discussed the problem as I was running into on https://github.com/spring-cloud/spring-cloud-config/issues/84.  During that time, I was missing the keystore in the client side but it does not solve my problem when I try to deploy Config Server into production.\r\n\r\n*Background*\r\nI am deploying the Config Server as a company wide shared configuration service (for production and non-production environment by using the profile annotation).  Since all the production passwords are encrypted using the Config Server /encrypt endpoint, it is not OK to allow developers have direct access to the Config Server without authentication.\r\n\r\nI was planning to use the basic HTTP authentication with the Config Server and its bootstrap.yml looks like the following:\r\n\r\n<pre>\r\nencrypt:\r\n  failOnError: false\r\n  keyStore:\r\n    location: classpath:config-server.jks\r\n    alias: config-server\r\n    password: f7hkjd764jAl\r\n</pre>\r\n\r\nand the configserver.yml looks like the following, where the password was encrypted using it's own /encrypt endpoint with the config-server.jks keystore:\r\n\r\n<pre>\r\nsecurity:\r\n  user:\r\n    name: foobar\r\n    password: \"{cipher}AQAUtSkpM24ClZ81a/696J8Fdr2gkZUSsT2A4Zr4RBsRx4CNpWO+/f0Xs2Cazusjm3sRRABCgdkU6EZWWnrul/Up6DsgW5F3tzEgFMv51hZ4kw8hdkOXkZhohuOAIvMz6ZK4/d4kiDzRPxxWextAmvc+umCOfgRoFxFzi86wfvqO+WpAo41aOMRBC16kdycjs2zq8PG1FiZ631a11hNd0VB8N55kshXq0pTSoXLu3d7r2BwEogdhdrbeeuZ9Vfr1419aVJAxFmEIwni3pdn3Yj8bk/NbL0VQAXJPSlrbocNh1bWkSguX3g0pA44YqEIhwjQwsX3D10q1LIJrkcjEmKosydyuU3od46GDMMQDBaOETA7nKorCjFDR/ppi02TS59s=\"\r\n</pre>\r\n\r\nOn the client side, the bootstrap.yml looks like the following:\r\n\r\n<pre>\r\nspring:\r\n  application:\r\n    itemName: my-service\r\n  cloud:\r\n    config:\r\n      uri: http://config.server.internal:8080\r\n      failFast: true\r\n      username: foobar\r\n      password: \"{cipher}AQAUtSkpM24ClZ81a/696J8Fdr2gkZUSsT2A4Zr4RBsRx4CNpWO+/f0Xs2Cazusjm3sRRABCgdkU6EZWWnrul/Up6DsgW5F3tzEgFMv51hZ4kw8hdkOXkZhohuOAIvMz6ZK4/d4kiDzRPxxWextAmvc+umCOfgRoFxFzi86wfvqO+WpAo41aOMRBC16kdycjs2zq8PG1FiZ631a11hNd0VB8N55kshXq0pTSoXLu3d7r2BwEogdhdrbeeuZ9Vfr1419aVJAxFmEIwni3pdn3Yj8bk/NbL0VQAXJPSlrbocNh1bWkSguX3g0pA44YqEIhwjQwsX3D10q1LIJrkcjEmKosydyuU3od46GDMMQDBaOETA7nKorCjFDR/ppi02TS59s=\"\r\nencrypt:\r\n  failOnError: false\r\n  keyStore:\r\n    location: classpath:config-server.jks\r\n    alias: config-server\r\n    password: f7hkjd764jAl\r\n</pre>\r\n\r\nNow, my problem is:  The developers have full access to the server side key-pair.  In other words, the developers can decrypt the {cipher} password from the properties files by using the keystore.  It is completely defeated the purpose of server side encryption.\r\n\r\n*Questions*\r\n# Is it possible using a different keypair for config server login credential?\r\n# I may be still do it completely wrong up there.  Any correction is helpful since the current document is very unclear on how to use encrypted password for http authentication."}}