Skip to content

IDP: avoid logging value of 'idp_client_secret' #8332

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alexey-tikhonov merged 3 commits into from
Jan 13, 2026
Merged

IDP: avoid logging value of 'idp_client_secret' #8332

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ec88ee4
DP: use 'SSSDBG_CONF_SETTINGS' to log options
alexey-tikhonov Jan 7, 2026
43db9b5
IDP: avoid logging value of 'idp_client_secret'
alexey-tikhonov Jan 7, 2026
b291944
OIDC_CHILD: don't log 'post_data' content
alexey-tikhonov Jan 12, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions src/confdb/confdb.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -264,6 +264,9 @@
#define CONFDB_PROXY_FAST_ALIAS "proxy_fast_alias"
#define CONFDB_PROXY_MAX_CHILDREN "proxy_max_children"

/* IdP Provider */
#define CONFDB_IDP_CLIENT_SECRET "idp_client_secret"

/* KCM Service */
#define CONFDB_KCM_CONF_ENTRY "config/kcm"
#define CONFDB_KCM_SOCKET "socket_path"
Expand Down
4 changes: 2 additions & 2 deletions src/oidc_child/oidc_child.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -155,13 +155,13 @@ static errno_t read_client_secret_from_stdin(TALLOC_CTX *mem_ctx,

ret = read_from_stdin(mem_ctx, &str);
if (ret != EOK) {
DEBUG(SSSDBG_OP_FAILURE, "read_from_stdin failed.\n");
DEBUG(SSSDBG_OP_FAILURE, "read_from_stdin() failed.\n");
return ret;
}

*out = str;

DEBUG(SSSDBG_TRACE_ALL, "Client secret: [%s].\n", *out);
DEBUG(SSSDBG_TRACE_ALL, "Client secret was read.\n");

return EOK;
}
Expand Down
3 changes: 2 additions & 1 deletion src/oidc_child/oidc_child_curl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -256,7 +256,8 @@ static errno_t set_http_opts(CURL *curl_ctx, struct rest_ctx *rest_ctx,
}

if (post_data != NULL) {
DEBUG(SSSDBG_TRACE_ALL, "POST data: [%s].\n", post_data);
/* Don't log 'post_data' content as it might contain 'secret' */
DEBUG(SSSDBG_TRACE_ALL, "Setting POST data.\n");
res = curl_easy_setopt(curl_ctx, CURLOPT_POSTFIELDS, post_data);
if (res != CURLE_OK) {
DEBUG(SSSDBG_OP_FAILURE, "Failed to add data to POST request.\n");
Expand Down
39 changes: 25 additions & 14 deletions src/providers/data_provider_opts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -88,6 +88,22 @@

/* =Retrieve-Options====================================================== */

static inline void log_string_option(const struct dp_option *opt)
{
if (strcmp(opt->opt_name, CONFDB_IDP_CLIENT_SECRET) == 0) {
/* avoid logging value of sensitive option */
DEBUG(SSSDBG_CONF_SETTINGS,
"Option "CONFDB_IDP_CLIENT_SECRET" is%s set\n",

Check warning on line 96 in src/providers/data_provider_opts.c

View workflow job for this annotation

GitHub Actions / cppcheck 

There is an unknown macro here somewhere. Configuration is required. If CONFDB_IDP_CLIENT_SECRET is a macro then please configure it.
opt->val.cstring ? "" : " not");
return;
}

DEBUG(SSSDBG_CONF_SETTINGS, "Option %s has%s value %s\n",
opt->opt_name,
opt->val.cstring ? "" : " no",
opt->val.cstring ? opt->val.cstring : "");
}

int dp_get_options(TALLOC_CTX *memctx,
struct confdb_ctx *cdb,
const char *conf_path,
Expand Down Expand Up @@ -123,10 +139,8 @@
if (ret == EOK) ret = EINVAL;
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s has%s value %s\n",
opts[i].opt_name,
opts[i].val.cstring ? "" : " no",
opts[i].val.cstring ? opts[i].val.cstring : "");

log_string_option(&opts[i]);
break;

case DP_OPT_BLOB:
Expand All @@ -151,7 +165,7 @@
opts[i].val.blob.length = 0;
}

DEBUG(SSSDBG_TRACE_FUNC, "Option %s has %s binary value.\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s has %s binary value.\n",
opts[i].opt_name, opts[i].val.blob.length?"a":"no");
break;

Expand All @@ -166,7 +180,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s has value %d\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s has value %d\n",
opts[i].opt_name, opts[i].val.number);
break;

Expand All @@ -181,7 +195,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s is %s\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s is %s\n",
opts[i].opt_name, opts[i].val.boolean?"TRUE":"FALSE");
break;
}
Expand Down Expand Up @@ -227,10 +241,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s has%s value %s\n",
opts[i].opt_name,
opts[i].val.cstring ? "" : " no",
opts[i].val.cstring ? opts[i].val.cstring : "");
log_string_option(&opts[i]);
break;

case DP_OPT_BLOB:
Expand All @@ -245,7 +256,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s has %s binary value.\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s has %s binary value.\n",
opts[i].opt_name, opts[i].val.blob.length?"a":"no");
break;

Expand All @@ -261,7 +272,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s has value %d\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s has value %d\n",
opts[i].opt_name, opts[i].val.number);
break;

Expand All @@ -277,7 +288,7 @@
opts[i].opt_name);
goto done;
}
DEBUG(SSSDBG_TRACE_FUNC, "Option %s is %s\n",
DEBUG(SSSDBG_CONF_SETTINGS, "Option %s is %s\n",
opts[i].opt_name, opts[i].val.boolean?"TRUE":"FALSE");
break;
}
Expand Down
2 changes: 1 addition & 1 deletion src/providers/idp/idp_init.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -111,7 +111,7 @@
IDP_CLIENT_SECRET);
if (init_ctx->client_secret == NULL) {
DEBUG(SSSDBG_CRIT_FAILURE,
"Missing required option 'idp_client_secret'.\n");
"Missing required option '"CONFDB_IDP_CLIENT_SECRET"'.\n");

Check warning on line 114 in src/providers/idp/idp_init.c

View workflow job for this annotation

GitHub Actions / cppcheck 

There is an unknown macro here somewhere. Configuration is required. If CONFDB_IDP_CLIENT_SECRET is a macro then please configure it.
ret = EINVAL;
goto done;
}
Expand Down
2 changes: 1 addition & 1 deletion src/providers/idp/idp_opts.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ struct dp_option default_idp_opts[] = {
{ "idp_request_timeout", DP_OPT_NUMBER, { .number = 10 }, NULL_NUMBER },
{ "idp_type", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "idp_client_id", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "idp_client_secret", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ CONFDB_IDP_CLIENT_SECRET, DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "idp_token_endpoint", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "idp_device_auth_endpoint", DP_OPT_STRING, NULL_STRING, NULL_STRING },
{ "idp_userinfo_endpoint", DP_OPT_STRING, NULL_STRING, NULL_STRING },
Expand Down