OrientDB ETL doesn't require password

[Gregory Pierce]

So I just finished performing an ETL on a remote database when I realized - I didn't have to specify a username or password for this ETL to run. However when I try to access the database I do need to have a username/password or else the interface will have issues. Is there somewhere special that I need to configure that OrientDB should be requesting credentials by default?

The below config (masked obviously) worked on several instances.

{

    "source": { "file": { "path": "localCSVFile.csv"} },

    "extractor": { "row": {} },

    "transformers":[

        {"csv": {} },

        {"vertex": {"class": "Stuff"}}

    ],

    "loader": {

        "orientdb": {

            "dbURL": "remote:somedatabaseURL",

            "dbType": "graph",

            "classes": [

                {"name": "Stuff", "extends": "V"}

            ],

            "indexes": [

                {"class":"Stuff", "fields":["merchantId:integer"], "type":"UNIQUE"}

            ]

        }

    }

}

[Giulia Brignoli]

Hi,

the username and password are written to the file OrientDB-server-config in the config folder OrientDB

Regards,

Giulia

[Gregory Pierce]

Not sure I understand your answer. The ETL is able to load data into a database that it has never connected to and to which I don't have any credentials for. Essentially I can upload any random data to that instance without having to provide any credentials at all. That's definitely not right, so I'm looking for how to secure the database such that an ETL cannot push data to the database and bypass the security which the database driver provides.

Today if I want to connect to the database I need a user/password. If I don't have that I can't connect. That's good. However if I ETL to that database I can upload data to it without knowing the user/password. That's awful!

[Luca Garulli]

Hi,

In this case the default user and password are taken: "admin". Try to change the admin's password and you'll see the ETL will be not able to connect to the server anymore.

Best Regards,

Luca Garulli

Founder & CEO

OrientDB

On 18 August 2015 at 19:41, Gregory Pierce <gregor...@gmail.com> wrote:

Not sure I understand your answer. The ETL is able to load data into a database that it has never connected to and to which I don't have any credentials for. Essentially I can upload any random data to that instance without having to provide any credentials at all. That's definitely not right, so I'm looking for how to secure the database such that an ETL cannot push data to the database and bypass the security which the database driver provides.

Today if I want to connect to the database I need a user/password. If I don't have that I can't connect. That's good. However if I ETL to that database I can upload data to it without knowing the user/password. That's awful!

--

---
You received this message because you are subscribed to the Google Groups "OrientDB" group.
To unsubscribe from this group and stop receiving emails from it, send an email to orient-databa...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Gregory Pierce]

Perfect Luca, thanks for the response. I will test this so I can close this issue internally.

--

---
You received this message because you are subscribed to a topic in the Google Groups "OrientDB" group.
To unsubscribe from this topic, visit https://groups.google.com/d/topic/orient-database/XhHuInXNA3g/unsubscribe.
To unsubscribe from this group and all its topics, send an email to orient-databa...@googlegroups.com.