[PUP-9585] Do not output password for user type if it is marked Sensitive - Puppet Jira Server

XML

Word

Printable

Acceptance Criteria:

Hide

Passwords for the user type are output in Debug logging, even if the value is marked Sensitive. Instead, this should be written as "[redacted]" in the log.

Show
Passwords for the user type are output in Debug logging, even if the value is marked Sensitive. Instead, this should be written as " [redacted] " in the log.
Epic Link:
Redacting Sensitive Data
Team:
Coremunity
Sprint:
Platform Core KANBAN

Release Notes:
Bug Fix
Release Notes Summary:
User providers will not output exec command lines with passwords during debugging level logging.

Reproduction steps:

$ cat foo.pp

class foo {

  user {'foo':

    ensure => present,

    password => Sensitive("foo")

include foo

puppet apply foo.pp --debug

Info: Applying configuration version '8ef5cbfc620ff86bc1c8c02a56c5dc16d3630db4'

Debug: Executing: '/sbin/useradd -p foo -M foo'

is duplicated by

PUP-9692 hiera explain should redact values converted to Sensitive in --debug mode