Add secure setting for watcher email password

x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/notification/email/Account.java

@@ -7,6 +7,9 @@
 
 import org.apache.logging.log4j.Logger;
 import org.elasticsearch.SpecialPermission;
+import org.elasticsearch.common.settings.SecureSetting;
+import org.elasticsearch.common.settings.SecureString;
+import org.elasticsearch.common.settings.Setting;
 import org.elasticsearch.common.settings.Settings;
 import org.elasticsearch.common.settings.SettingsException;
 import org.elasticsearch.common.unit.TimeValue;
@@ -28,6 +31,8 @@
 public class Account {
 
     static final String SMTP_PROTOCOL = "smtp";
+    static final String SMTP_PASSWORD = "password";
+    private static final Setting<SecureString> SECURE_PASSWORD_SETTING = SecureSetting.secureString("secure_" + SMTP_PASSWORD, null);
 
     static {
         SecurityManager sm = System.getSecurityManager();
@@ -204,13 +209,30 @@ static class Smtp {
 
             Smtp(Settings settings) {
                 host = settings.get("host", settings.get("localaddress", settings.get("local_address")));
+
                 port = settings.getAsInt("port", settings.getAsInt("localport", settings.getAsInt("local_port", 25)));
                 user = settings.get("user", settings.get("from", null));
-                String passStr = settings.get("password", null);
+                String passStr = getNullableSetting(SMTP_PASSWORD, settings, SECURE_PASSWORD_SETTING);
                 password = passStr != null ? passStr.toCharArray() : null;
                 properties = loadSmtpProperties(settings);
             }
 
+            /**
+             * Finds a setting, and then a secure setting if the setting is null, or returns null if one does not exist. This differs
+             * from other getSetting calls in that it allows for null whereas the other methods throw an exception.
+             */
+            private static String getNullableSetting(String settingName, Settings settings, Setting<SecureString> secureSetting) {
+                String value = settings.get(settingName);
+                if (value == null) {
+                    SecureString secureString = secureSetting.get(settings);
+                    if (secureString != null && secureString.length() > 0) {
+                        value = secureString.toString();
+                    }
+                }
+
+                return value;
+            }
+
             /**
              * loads the standard Java Mail properties as settings from the given account settings.
              * The standard settings are not that readable, therefore we enabled the user to configure
@@ -232,7 +254,10 @@ static Properties loadSmtpProperties(Settings settings) {
                 settings = builder.build();
                 Properties props = new Properties();
                 for (String key : settings.keySet()) {
-                    props.setProperty(SMTP_SETTINGS_PREFIX + key, settings.get(key));
+                    // Secure strings can not be retreived out of a settings object and should be handled differently
+                    if (key.startsWith("secure_") == false) {
+                        props.setProperty(SMTP_SETTINGS_PREFIX + key, settings.get(key));
+                    }
                 }
                 return props;
             }

x-pack/plugin/watcher/src/main/java/org/elasticsearch/xpack/watcher/notification/email/EmailService.java

@@ -7,6 +7,8 @@
 
 import org.elasticsearch.common.Nullable;
 import org.elasticsearch.common.settings.ClusterSettings;
+import org.elasticsearch.common.settings.SecureSetting;
+import org.elasticsearch.common.settings.SecureString;
 import org.elasticsearch.common.settings.Setting;
 import org.elasticsearch.common.settings.Setting.Property;
 import org.elasticsearch.common.settings.Settings;
@@ -63,6 +65,10 @@ public class EmailService extends NotificationService<Account> {
             Setting.affixKeySetting("xpack.notification.email.account.", "smtp.password",
                     (key) -> Setting.simpleString(key, Property.Dynamic, Property.NodeScope, Property.Filtered));
 
+    private static final Setting.AffixSetting<SecureString> SETTING_SECURE_PASSWORD =
+        Setting.affixKeySetting("xpack.notification.email.account.", "smtp.secure_password",
+            (key) -> SecureSetting.secureString(key, null));
+
     private static final Setting.AffixSetting<TimeValue> SETTING_SMTP_TIMEOUT =
             Setting.affixKeySetting("xpack.notification.email.account.", "smtp.timeout",
                     (key) -> Setting.timeSetting(key, TimeValue.timeValueMinutes(2), Property.Dynamic, Property.NodeScope));
@@ -108,6 +114,7 @@ public EmailService(Settings settings, @Nullable CryptoService cryptoService, Cl
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_PORT, (s, o) -> {}, (s, o) -> {});
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_USER, (s, o) -> {}, (s, o) -> {});
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_PASSWORD, (s, o) -> {}, (s, o) -> {});
+        clusterSettings.addAffixUpdateConsumer(SETTING_SECURE_PASSWORD, (s, o) -> {}, (s, o) -> {});
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_TIMEOUT, (s, o) -> {}, (s, o) -> {});
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_CONNECTION_TIMEOUT, (s, o) -> {}, (s, o) -> {});
         clusterSettings.addAffixUpdateConsumer(SETTING_SMTP_WRITE_TIMEOUT, (s, o) -> {}, (s, o) -> {});
@@ -168,7 +175,7 @@ public static List<Setting<?>> getSettings() {
         return Arrays.asList(SETTING_DEFAULT_ACCOUNT, SETTING_PROFILE, SETTING_EMAIL_DEFAULTS, SETTING_SMTP_AUTH, SETTING_SMTP_HOST,
                 SETTING_SMTP_PASSWORD, SETTING_SMTP_PORT, SETTING_SMTP_STARTTLS_ENABLE, SETTING_SMTP_USER, SETTING_SMTP_STARTTLS_REQUIRED,
                 SETTING_SMTP_TIMEOUT, SETTING_SMTP_CONNECTION_TIMEOUT, SETTING_SMTP_WRITE_TIMEOUT, SETTING_SMTP_LOCAL_ADDRESS,
-                SETTING_SMTP_LOCAL_PORT, SETTING_SMTP_SEND_PARTIAL, SETTING_SMTP_WAIT_ON_QUIT);
+                SETTING_SMTP_LOCAL_PORT, SETTING_SMTP_SEND_PARTIAL, SETTING_SMTP_WAIT_ON_QUIT, SETTING_SECURE_PASSWORD);
     }
 
 }