Clear text passwords stored in cwd_directory_attribute - embedded Crowd and Standalone

Hi all

I just notiecd that Crowd (embedded version as well as standalone) stores passwords for directories and applications in clear text (table cwd_directory_attribute / ldap.password & application.password). I believe that is a big security issue so I wonder if there is a workaround available or if this is just a matter of configuration?

Thanks

Peter

1 answer

1 vote

There is an open Crowd issue for this - CWD-1876. However, if the password in the database is encrypted, this still leaves the problem of how to store the master key securely.

Suggest an answer

Log in or Sign up to answer
Community showcase
Posted yesterday in Featured Groups

Tuesday tips & tricks: What is the Atlassian Community?

It's officially Tuesday, which means it's officially time for another tip to help you better navigate this space we call the Atlassian Community. 😄 I got a great question from community member, Sa...

25 views 0 2
View post

Atlassian User Groups

Connect with like-minded Atlassian users at free events near you!

Find a group

Connect with like-minded Atlassian users at free events near you!

Find my local user group

Unfortunately there are no AUG chapters near you at the moment.

Start an AUG

You're one step closer to meeting fellow Atlassian users at your local meet up. Learn more about AUGs

Groups near you