6 Replies Latest reply on Jul 28, 2014 9:21 AM by davsclaus

password vault instead of clear user credentials

virchete Jul 14, 2014 8:39 AM

Hi,

I work for the project Jboss Overlord. We deploy our product in Fuse and right now what we do is just copy a user.properties file into the fuse/etc folder.

The user.properties file does store the clear text user's credentials . It is not stored encrypted.

For example in jboss eap, it is made possible by using the Vault, which allows us to store passwords in the vault and then refer to those vault locations from our config files.

We do not know if something similar can be applied in Fuse.

Thanks a lot

David

1. Re: password vault instead of clear user credentials

davsclaus Jul 14, 2014 2:58 PM (in response to virchete)

I think etc/users.properties gets encrypted when fuse 6.1 startup. So you can add the users with cleartext password, but fuse should resave the file with encrypted passwords.
Actions
2. Re: password vault instead of clear user credentials

ffang Jul 15, 2014 6:02 AM (in response to virchete)

Hi,

You can edit
$JBOSS_FUSE/etc/org.apache.karaf.jaas.cfg
change
encryption.enabled = false
to
encryption.enabled = true

then the clear plain text password would be encrypted.

Freeman
Actions
3. Re: password vault instead of clear user credentials

virchete Jul 28, 2014 7:58 AM (in response to ffang)

Hi,

I am trying to add with Ant a new user encrypted in the users.properties.

As I have seen in the $JBOSS_FUSE/etc/org.apache.karaf.jaas.cfg by default the encryption algorithm is MD5 and the encoding is hexadecimal.

So I tried then

MessageDigest md = MessageDigest.getInstance("MD5");
//Add password bytes to digest
md.update(password.getBytes());
//Get the hash's bytes
byte[] bytes = md.digest();

//Get complete hashed password in hex format
generatedPassword = new String(Hex.encodeHex(bytes));

This generates an encryption that is different than the encryption generated using the karaf console, jaas:adduser command.

Could you tell me how this encryption is done internally by fuse, to make exactly the same encryption?

Thanks
Actions
4. Re: password vault instead of clear user credentials

davsclaus Jul 28, 2014 8:06 AM (in response to virchete)

Yeah its open source, so try to find the spot in the code where its done.
Actions
5. Re: password vault instead of clear user credentials

virchete Jul 28, 2014 8:14 AM (in response to davsclaus)

Could you provide me a link to the fuse jaas adduser command class,? Because sincerely I couldn't find it.

Thanks
Actions
6. Re: password vault instead of clear user credentials

davsclaus Jul 28, 2014 9:21 AM (in response to virchete)

Its in Apache Karaf
Actions

Go to original post

	MessageDigest md = MessageDigest.getInstance("MD5");

	//Add password bytes to digest
	md.update(password.getBytes());
	//Get the hash's bytes
	byte[] bytes = md.digest();

	//Get complete hashed password in hex format
	generatedPassword = new String(Hex.encodeHex(bytes));