Red Hat Training

A Red Hat training course is available for Red Hat JBoss Enterprise Application Platform

7.6. Configure JBoss EAP 6 to Use the Password Vault

Overview

Before you can mask passwords and other sensitive attributes in configuration files, you need to make JBoss EAP 6 aware of the password vault which stores and decrypts them.

Prerequisites

Procedure 7.5. Enable the Password Vault

  • Run the following Management CLI command, substituting the placeholder values with those from the output of the Password Vault command in Section 7.4, “Initialize the Password Vault”.

    Note

    If you use Microsoft Windows Server, use two backslashes (\\) in the file path where you would normally use one. For example, C:\\data\\vault\\vault.keystore. This is because a single backslash character (\) is used for character escaping. 
    /core-service=vault:add(vault-options=[("KEYSTORE_URL" => "PATH_TO_KEYSTORE"), ("KEYSTORE_PASSWORD" => "MASKED_PASSWORD"), ("KEYSTORE_ALIAS" => "ALIAS"), ("SALT" => "SALT"),("ITERATION_COUNT" => "ITERATION_COUNT"), ("ENC_FILE_DIR" => "ENC_FILE_DIR")])

Example 7.4. Enable the Password Vault

/core-service=vault:add(vault-options=[("KEYSTORE_URL" => "EAP_HOME/vault/vault.keystore"), ("KEYSTORE_PASSWORD" => "MASK-5dOaAVafCSd"), ("KEYSTORE_ALIAS" => "vault"), ("SALT" => "1234abcd"),("ITERATION_COUNT" => "120"), ("ENC_FILE_DIR" => "EAP_HOME/vault/")])
Result

JBoss EAP 6 is configured to decrypt masked strings stored in the Password Vault. To add strings to the Password Vault and use them in your configuration, see Section 7.8, “Store a Sensitive String in the Password Vault”.

Report a bug