JBoss Applications migrating to Elytron Vault

[Lakshmi B]

Hi All,

Is there a way to dynamically decrypt password at web application when secret stored in JBoss Wildfly 7.4 Elytron store with extension like "*.cs"?

Example:

1. Created Elytron store called credstore and store type credstore.cs
2. Stored web service user name and password in the credstore.cs using alias called username and password
3. added system-property  as kay/value pair as follow...

<system-property>

    <property name="wsusername" value="<Plain text WS username/>

<property name="wspassword" value="{credstore}:{password}" />

</system-property>  

4. programmatically accessing  wspassword via System.getProperty("wspassword"), is not real decrypted password that i store in Elytron, instead i see same as system property value from above as example

Is there a way to dynamically access actual secret stored in Elytron cred store using alias in java web appl?

[Ken Wills]

Hi Lakshmi,

This is usually done using expressions, see here for a guide on how to set it up (including using system properties)

https://wildfly-security.github.io/wildfly-elytron/blog/using-credential-stores-with-encrypted-expressions-on-wildfly/

Ken

 

--
You received this message because you are subscribed to the Google Groups "WildFly" group.
To unsubscribe from this group and stop receiving emails from it, send an email to wildfly+u...@googlegroups.com.
To view this discussion visit https://groups.google.com/d/msgid/wildfly/76c740d8-6b78-400a-90a6-c1846762376dn%40googlegroups.com.

[Gabriel Padilha]

I understand you want to access the Elytron credential store directly from the application. This class may can help you: https://gist.github.com/gabrielpadilh4/819fa4c3741414c46fec2a7dd822cc80 

The above class is an alternative to https://github.com/wildfly-security-incubator/elytron-examples/tree/main/credential-store 

It should do the job! 

Thanks!

[Lakshmi B]

Thanks Ken, I had tried this but application was not auto decrypting when retrieving from system property, not sure why this  ENC expression is useful for,  other then just storing encrypted password in xml file. Thanks for the link, Ken!

[Lakshmi B]

Yes, custom keystore API  needed to retrieve creds from Elytron store, do not think if there is way to get directly from Elytron store or decrypt ENC: version of password from system property file with one line of code in application. Thanks!