Repository navigation
Is there any way to encrypt db-password in keycloak.conf (version 18)? #19104
Replies: 4 comments 2 replies
|
Have you thought about passing the password as an environment variable? |
|
Yes, we proposed that but that option is no viable for our client. If you have other idea we appreciate it! I search a lot in internet but I couldn't find anything |
|
As far as I can tell, passwords cannot truly be encrypted if the services should be able to start unattended, as you still need to be able to decrypt them at some point during the startup process. Because of this, even if the password itself is encrypted, you will still need a key to encrypt it, that (at some point, if you repeat these steps) cannot be encrypted. A somewhat capable adversary with filesystem access will likely be able to follow a few breadcrumbs to get to the unencrypted password. That being said, I think version 18 has support for (some) vault types, as described in the server administration guilde and the Using kubernetes secrets guide, which may help, but I'm afraid I do not know for sure. It may be only available for SMTP, LDAP and OIDC, but not for the database connection. There could be some interesting integrations with keyring services or the kernel key retention service on Linux, or Credential Manager on Windows, but they are not available currently from what I could find. Without any more information about the deployment, I can only give some generic advise - reduce the permissions on the config file as much as possible (the file should be read-only, and accessible to the user that runs Keycloak), and the environment variables can usually be set for both systemd services (on Linux) and containers, which should allow passing the password to Keycloak. You may be able to achieve a behavior similar to what you would expect from password encryption by changing the startup script to decrypt the (encrypted) password (that is stored in a different file) and to then generate a temporary config file that contains the unencrypted password. The temporary file could be deleted as soon as the Keycloak process starts, since the data is not removed from the disk as long as there is a process that references it - for extra security the file could be stored in a ramdisk. But if you go through all this trouble, it may be safer to just use a dedicated SPI. |
|
Thank darius-m for you time and your detailed explanation. I will explain all of this to our client, and take a decision of what strategy we decide to apply. |
|
Have you encrypted the dB password in any of the way? We have same situation to encrypt the password and use it startup process. |
|
Depending on your database and environment, you could go password-less and authenticate with the user the service is running with. Besides that, encrypting the password is probably not worth much. |
Uh oh!
There was an error while loading. Please reload this page.
Hi there,
We are actually working in deploy keycloak 18 in production, but there is a big problem with our client because we are not encrypting db-password in our keycloak.conf. Is there any way to do that? Is there a way where keycloak understand an encrypted password to connect with DB and if it is possible what algorithm could we use?
Regards,
Sonia
All reactions