View Issue Details
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0006846 | Taler | deployment and operations | public | 2021-04-14 12:07 | 2021-08-24 14:23 |
| Reporter | Florian Dold | Assigned To | MS | Resolution deadline | |
| Implementer | Reviewer | ||||
| Release signed by | Deployed by | ||||
| Verifier | Communicator | ||||
| Data protection authority notification required | No | ||||
| CSIRT notification required | No | ||||
| Estimated effort (hours) | Actual effort (hours) | 0 | |||
| Fast-track | No | ||||
| Work package | none | ||||
| Priority | high | Severity | minor | Reproducibility | have not tried |
| Status | closed | Resolution | fixed | ||
| Target Version | 0.8 | Fixed in Version | 0.8 | ||
| Summary | 0006846: use token auth with actual secret token for test/demo merchant instances, provide sandbox instance | ||||
| Description | Currently the merchant backend is not secured. That was initially intentional, but might cause trouble if somebody decides to mess with instances during a demo. We should: 1. Generate a random token when bootstraping the environment. Store this token in a plain-text file and read it into an environment variable in ~/activate. 2. The taler-deployment-config-instances script should set up token authentication with this secret token 3. The merchant frontend demos should use this token 4. We should create one special instance named "sandbox" that we create without token auth, but where we forbid administrative endpoints via an nginx whitelist. | ||||
| Tags | No tags attached. | ||||
| - Sync was recently fixed in this regard, but waits to be tested. - As for the 4. point: 'sandbox' instance got actually named "Tutorial", and instead of no token got one well-known, which is "sandbox". Those decisions happened after a private discussion. | |
| Setting as 'high' as it's close to resolution. | |
| Full deployed on demo, the way it is requested here. | |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2021-04-14 12:07 | Florian Dold | New Issue | |
| 2021-04-14 12:07 | Florian Dold | Status | new => assigned |
| 2021-04-14 12:07 | Florian Dold | Assigned To | => MS |
| 2021-05-13 07:00 | MS | Note Added: 0017846 | |
| 2021-05-13 07:01 | MS | Priority | normal => high |
| 2021-05-13 07:01 | MS | Note Added: 0017847 | |
| 2021-06-10 13:11 | MS | Status | assigned => informing |
| 2021-06-10 13:11 | MS | Resolution | open => fixed |
| 2021-06-10 13:11 | MS | Note Added: 0017947 | |
| 2021-07-30 11:56 | Christian Grothoff | Fixed in Version | => 0.8 |
| 2021-07-30 11:59 | Christian Grothoff | Target Version | => 0.8.1 |
| 2021-07-30 12:01 | Christian Grothoff | Target Version | 0.8.1 => 0.8 |
| 2021-08-24 14:23 | Christian Grothoff | Status | informing => closed |