Dataiku password security

Ankit96140
Ankit96140 Registered Posts: 9 ✭✭✭✭

Do Dataiku use AES-256 encryption to store the 3rd party passwords ? also is there any way to configure these algorithms

Also how frequently the encryption keys are rotated ?

Answers

  • Théophile
    Théophile Dataiker, Dataiku DSS Core Designer Posts: 6 Dataiker
    edited July 2024

    You can find more information here: https://doc.dataiku.com/dss/latest/security/passwords-security.html#rd-party-system-credentials.

    Both AES-128, AES-192 and AES-256 are supported, and you can configure your key length with the dip.properties:

    dku.security.passwordsEncryption.aesKeyLength

    Keep in mind that depending on your Java version you may need to adjust your JCE policy.

    There is no mechanism to rotate the encryption key. Fundamentally, DSS needs to be able to actually send the raw password so the encryption key is stored in the DSS data directory. So if the encryption key is compromised you should assume that the attacker also had access to the encrypted 3rd party password and you should consider that those 3rd party password are also compromised.

  • Tanguy
    Tanguy Dataiku DSS Core Designer, Dataiku DSS & SQL, Dataiku DSS ML Practitioner, Dataiku DSS Core Concepts, Neuron, Dataiku DSS Adv Designer, Registered, Dataiku DSS Developer, Neuron 2023 Posts: 129 Neuron

    Is there any way to reproduce the encryption outside of DSS (for configuration purposes) without using the dku utility (e.g. by using the dataiku api client)?

  • Turribeach
    Turribeach Dataiku DSS Core Designer, Neuron, Dataiku DSS Adv Designer, Registered, Neuron 2023 Posts: 2,188 Neuron

    No. You could use Python sub process to execute the command and get the output though.

  • Tanguy
    Tanguy Dataiku DSS Core Designer, Dataiku DSS & SQL, Dataiku DSS ML Practitioner, Dataiku DSS Core Concepts, Neuron, Dataiku DSS Adv Designer, Registered, Dataiku DSS Developer, Neuron 2023 Posts: 129 Neuron

    We’ve found a workaround! 😊

    For context, we configure Dataiku externally using the Dataiku API client. While setting up third-party databases, we initially had to pass an encrypted password because we were using deprecated methods (namely connexion.get_definition() and connexion.set_definition()). However, we discovered that with the newer method (connexion.get_settings().get_raw()), Dataiku automatically encrypts the password when saving the connection settings. This means there’s no need for manual encryption anymore — Dataiku conveniently takes care of it for us! 🙌

Setup Info
    Tags
      Help me…