Showing posts with label information. Show all posts
Showing posts with label information. Show all posts

Tuesday, August 19, 2008

how to clear subeclipse password (svn for eclipse)?

Both subversion and subclipse cache usernames and passwords. Sometimes it is necessary to manually change the authentication information, e.g. to clear the password after it has changed, or occasionally, to update the username.

Anyone that uses subclipse (the subversion client for eclipse) that has needed to change the username or password for a stored repository, knows that there is no obvious way to do this. Luckily, I ran across this post. Unfortunately, it left some important details out.

If subclipse is setup to use JavaHL (which it is by default: check in Preferences > Team > SVN > SVN interface), then the passwords are stored in the same location as if the command-line svn tool was used. For unix-based systems (or using the command-line tool under cygwin), this is in ~/.subversion/auth/svn.simple. On windows it is in c:\Documents and Settings\[username]\Application Data\subversion\auth\svn.simple. It looks like there is one file per repository in this directory (the filename is a long hexadecimal number). This file contains your username and password.
On the other hand, if subclipse is configured to use the JavaSVN adapter, the .keyring file mentioned in the post appears to be located in the eclipse directory (not the workspace, the actually directory where the eclipse executable is found) under configuration/org.eclipse.core.runtime/.keyring. This is a binary file and hence must be deleted.

A few complaints: (1) I don’t like the fact my password is stored plaintext in a location where others frequently have at least read access to (this is especially true in Windows) (2) if the keyring is stored in the Eclipse directory that means all users share the same authentication information. That means someone else on the computer could access my subversion repositories as me!

This seems like a huge security whole.