-
Task
-
Resolution: Done
-
High
-
None
-
None
-
None
-
Dublin-4, Dublin-5
Add ability to provision administrator credentials for basic authentication.
Current Casablanca authentication accepts any provided credentials.
CMSO was called out due to security exposure due to com.fasterxml.jackson.core:jackson-databind:2.9.7 Adding this authentication will mitigate this exposure as basic authentication would ensure messages processed by Spring Boot are from trusted sources.
This fix will be required to support OPTFRA-386. Otherwise, there is no real exposure with CMSO running in standalone mode.
This issue will be mitigated by implementation of AAF which is to be implemented in the Dublin release. OPTFRA-390.