[Fuel Web] Incorrect password

[Tony Tarasov]

Hello we are using MOS 5.1
Customer changed the password with Fuel UI using special button there.
After that he was not able to run the command: fuel node list, because the file /etc/fuel/client/config.yaml was not changed.
 The only way to work with CLI is to change the file /etc/fuel/client/config.yaml
Seems that we cant work with Fuel CLI if we don't know the Admin password.
We need to change the file /etc/fuel/client/config.yaml automatically in the time, when we changing the password inside the Fuel UI

[Tomasz 'Zen' Napierala (tzn)]

This file is client config, generated for convenience. Like with every config file, after changing password, you need to change config

[Łukasz Oleś (loles)]

Storing user password in plain text in file is unsafe it shouldn't be done automatically.
If user changed password and he is trying use Fuel CLI he will get message, how he can provide password.

[Tony Tarasov (atarasov)]

Yes you are right. But what user should do if someone who changed the password, isn't him?
For example - I'm a FuelMaster admin and you some deployment engineer.
I created some MasterNode for you and you changed the password and then leave this company or in the travel. So I can't reach you...
My boss says - do what needed ASAP, and i can't do anything without this pass from CLI. So I think that it's great issue in topology of getting access.
Admin must have some privileges inside CLI to have the full access with my credentials (don't forget that we using "root" for that and I able to go inside any node and destroy it if I will want it, That means that I do not care about any password there in some document).

[Tony Tarasov (atarasov)]

By the way. "Storing user password in plain text in file is unsafe it shouldn't be done automatically."
Sorry, but it is the way, that you provide our customers with, don't you?

[Mike Scherbakov (mihgen)]

> By the way. "Storing user password in plain text in file is unsafe it shouldn't be done automatically."
> Sorry, but it is the way, that you provide our customers with, don't you?
We do not. Default configuration is shipped with admin/admin. Once user changes the password (and it is highly recommended), no password stored in the clear text in config file.

If you speak about two users, then please create the second user in Keystone. Currently there is no such feature in UI, but you can use Keystone client for it (and it should be documented).

Auto-update the config file with pass in plain text is unacceptable from security standpoint. Take Horizon for example - if you update password there, your ".openrc" file on controllers won't be updated. Fuel is no difference here.

Let's think how we can improve documentation, so this information would be easy to consume for users, and to avoid such questions in the future.

[Mike Scherbakov (mihgen)]

Per conversation with Anton Tarasov we will just provide a user an ability to set username/password from the CLI. Separate bug for it: https://bugs.launchpad.net/fuel/+bug/1381889.

Current one has to be marked as Invalid according to comments above.