16.7.6. Store and Retrieve Encrypted Sensitive Strings in the Java Keystore

Procedure 16.9. Setup the Java Keystore

1. Run the vault.sh command.

   Run EAP_HOME/bin/vault.sh. Start a new interactive session by typing 0.

2. Enter the directory where encrypted files will be stored.

   If you followed Section 16.7.2, “Create a Java Keystore to Store Sensitive Strings”, your keystore is in the directory EAP_HOME/vault. In most cases, it makes sense to store all of your encrypted information in the same place as the key store. Since this directory will contain sensitive information it should be accessible to only limited users. At a minimum the user account under which JBoss EAP is running requires read-write access.

   Note

   Do not forget to include the trailing slash on the directory name. Either use / or \, depending on your operating system.

3. Enter the path to the keystore.

   Enter the full path to the keystore file. This example uses EAP_HOME/vault/vault.keystore.

4. Enter the keystore password, vault name, salt, and iteration count.

   When prompted, enter the keystore password, vault name, salt, and iteration count. A handshake is performed.

5. Select the option to store a password.

   Select option 0 to store a password or other sensitive string.

6. Enter the value.

   When prompted, enter the value twice. If the values do not match, you are prompted to try again.

7. Enter the vault block.

   Enter the vault block, which is a container for attributes which pertain to the same resource. An example of an attribute name would be ds_ExampleDS. This will form part of the reference to the encrypted string, in your datasource or other service definition.

8. Enter the attribute name.

   Enter the name of the attribute you are storing. An example attribute name would be password.
   Result

   A message such as the one below shows that the attribute has been saved.

   Secured attribute value has been stored in vault.

9. Make note of the information about the encrypted string.

   A message prints to standard output, showing the vault block, attribute name, shared key, and advice about using the string in your configuration. Make note of this information in a secure location. Example output is shown below.

   ********************************************
   Vault Block:ds_ExampleDS
   Attribute Name:password
   Configuration should be done as follows:
   VAULT::ds_ExampleDS::password::1
   ********************************************
   

10. Use the encrypted string in your configuration.

    Use the string from the previous step in your configuration, in place of a plain-text string. A datasource using the encrypted password above is shown below.

    ...
      <subsystem xmlns="urn:jboss:domain:datasources:1.0">
        <datasources>
          <datasource jndi-name="java:jboss/datasources/ExampleDS" enabled="true" use-java-context="true" pool-name="H2DS">
            <connection-url>jdbc:h2:mem:test;DB_CLOSE_DELAY=-1</connection-url>
            <driver>h2</driver>
            <pool></pool>
            <security>
              <user-name>sa</user-name>
              <password>${VAULT::ds_ExampleDS::password::1}</password>
            </security>
          </datasource>
          <drivers>
             <driver name="h2" module="com.h2database.h2">
                <xa-datasource-class>org.h2.jdbcx.JdbcDataSource</xa-datasource-class>
             </driver>
          </drivers>
        </datasources>
      </subsystem>
    ...
    

    You can use an encrypted string anywhere in your domain or standalone configuration file where expressions are allowed.

    Note

    To check if expressions are allowed within a particular subsystem, run the following CLI command against that subsystem:

    /host=master/core-service=management/security-realm=TestRealm:read-resource-description(recursive=true)

    From the output of running this command, look for the value for the expressions-allowed parameter. If this is true, then you can use expressions within the configuration of this particular subsystem.
    After you store your string in the keystore, use the following syntax to replace any clear-text string with an encrypted one.

    ${VAULT::VAULT_BLOCK::ATTRIBUTE_NAME::ENCRYPTED_VALUE}

    Here is a sample real-world value, where the vault block is ds_ExampleDS and the attribute is password.

    <password>${VAULT::ds_ExampleDS::password::1}</password>