New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

Clean up binding permissions and account management #96

Open

jbrown-xentity opened this issue May 24, 2024 · 0 comments

Contributor

jbrown-xentity commented May 24, 2024

Currently when an app is bound to SOLR, new credentials are created. There are a number of security concerns with this process:

The read-only solr followers have an account created that is full admin; this doesn't make sense as the user shouldn't be editing the read only solr directly
The admin/leader solr and the read-only solr followers have the same password; that seems unnecessary and a security risk.

There are also problems with unbinding:

No usernames/passwords are ever removed, this seems like an oversight

All of this seems to be related to the code here, although there might need to be more research into cloud foundry unbinding

# for free to join this conversation on GitHub. Already have an account? # to comment