Insecure Test Credential

Stroom offers an optional shared secret that allows Stroom-Proxy, or a test script, to authenticate to Stroom as the internal processing user without an identity provider being involved. It exists so that a test or demonstration stack can function without standing up a real Identity Provider (IDP) Identity Provider (IDP) An Identity Provider is a system or service that can authenticate a user and assert their identity. Identity providers can support single sign on (SSO), which allows the user to sign in once to the Identity Provider so they are then authenticated to all systems using that IDP.Click to see more details....

Enabling the Test Credential

This is not part of the identity provider configuration. The identity provider, normally the internal one, handles all interactive sign in and token authentication as usual. The secret is an addition to that, not a substitute for it.

It is disabled unless both of the following are supplied, as environment variables or as system properties:

Supplying only the first has no effect other than an error in the logs.

Both are supplied at runtime rather than in a configuration file. This is deliberate. A configuration file copied from a test environment into production cannot carry the secret with it, so a production deployment that never sets these variables cannot be tricked into enabling this.

You choose the secret yourself; Stroom publishes none. A secret shared between systems for convenience is still not a credential to rely on outside test and demonstration use.

While it is enabled, Stroom logs a warning banner at startup, and logs again, at most every five minutes, whenever a request actually authenticates using it.

Configuring Stroom-Proxy to Use the Credential

Set the secret as Stroom-Proxy’s feed status API key, and give it the same value in Stroom’s environment:

  feedStatus:
    apiKey: "THE_VALUE_OF_STROOM_INSECURE_TEST_CREDENTIAL"
  security:
    authentication:
      openId:
        identityProviderType: NO_IDP

A request arriving at Stroom with this value as its bearer token is authenticated as the processing user.

For a secure equivalent, create an API Key API Key API Keys are a form of authentication token that are created within Stroom for use by Stroom-Proxy instances or other clients that want to use Stroom’s API. It is an encrypted string that contains details of the user and the expiration date of the token. Possession of a valid API Key for a user account means that you can do anything that the user can do in the user interface via the API.Click to see more details... in Stroom and use that as the proxy’s feedStatus.apiKey instead, leaving both settings above unset.