Securing password using key store

KIE Server uses basic authentication with passwords for some communication (e.g. the REST API). From a security perspective, it is not safe to store such passwords in clear text form on the disk. For this purpose, a mechanism was developed to store passwords in a key store and then use them in the application.

Simple use case

A user wants to secure the password used for communicating via the REST client. The user creates a new keystore to hold the password and sets up system variables with the keystore information; KIE then automatically loads the keystore and uses the stored password to secure the communication.

Implementation and business logic

The current implementation uses the key store if it is defined. If not, the functionality falls back to the old behavior of using configuration parameters.

System requirements

To use a key store, you need to create it first. As JKS does not support symmetric keys, you have to create a JCEKS key store. Moreover, a password can be stored in a key store only for Java 8 and above. To generate a key store, you can use the standard KeyTool utility, which is part of the JDK installation.

Initialization of a key store

For keystore initialization, we recommend using keytool. The syntax is the following:

${JAVA_HOME}/bin/keytool -importpassword -keystore _keystore_url_ -keypass _alias_key_password_ -alias _password_alias_ -storepass _keystore_password_ -storetype JCEKS

alias - alias name of the entry to process
keypass - key password
keystore - keystore name
storepass - keystore password
storetype - keystore type

After running this command, you will be asked to enter the password that you want to store.

System parameters for loading key store

kie.keystore.keyStoreURL - URL to a keystore which should be used
kie.keystore.keyStorePwd - password to a keystore
kie.keystore.key.server.alias - alias of the key for REST services where password is stored
kie.keystore.key.server.pwd - password of an alias for REST services with stored password
kie.keystore.key.ctrl.alias - alias of the key for default REST jBPM controller where password is stored
kie.keystore.key.ctrl.pwd - password of an alias for default REST jBPM controller with stored password

Example

Create a user and password in the application server (it must have the kie-server role).

$ ./bin/jboss-cli.sh --commands="embed-server --std-out=echo,/subsystem=elytron/filesystem-realm=ApplicationRealm:add-identity(identity=kieserver),/subsystem=elytron/filesystem-realm=ApplicationRealm:set-password(identity=kieserver, clear={password='kiePassword1!'}),/subsystem=elytron/filesystem-realm=ApplicationRealm:add-identity-attribute(identity=kieserver, name=role, value=['kie-server'])"

Use keytool to create a keystore with the password in it.

${JAVA_HOME}/bin/keytool -importpassword -keystore /home/kie/keystores/droolsServer.jceks -keypass keypwd -alias droolsKey -storepass serverpwd -storetype JCEKS

Enter the password to be stored:
Re-enter password:

${JAVA_HOME}/bin/keytool -importpassword -keystore /home/kie/keystores/droolsServer.jceks -keypass keypwd -alias restKey -storepass serverpwd -storetype JCEKS

Enter the password to be stored:
Re-enter password:

Set the following system properties on the application server that will let KIE Server or the jBPM controller read the password from the keystore.

    <system-properties>
        <property name="kie.keystore.keyStoreURL" value="file:///home/kie/keystores/droolsServer.jceks"/>
        <property name="kie.keystore.keyStorePwd" value="serverpwd"/>
        <property name="kie.keystore.key.server.alias" value="restKey"/>
        <property name="kie.keystore.key.server.pwd" value="keypwd"/>
        <property name="kie.keystore.key.ctrl.alias" value="droolsKey"/>
        <property name="kie.keystore.key.ctrl.pwd" value="keypwd"/>
    </system-properties>

Start the server to verify the configuration.

Home

Get started

AI Assistant

Core Concepts

Decision Control

Decision Control Tower

Drools

KIE Server

Guides

Platform

Deployment

Reference

FAQ

Securing password using key store

Simple use case

Implementation and business logic

System requirements

Initialization of a key store

System parameters for loading key store

Example

​Simple use case

​Implementation and business logic

​System requirements

​Initialization of a key store

​System parameters for loading key store

​Example

Simple use case

Implementation and business logic

System requirements

Initialization of a key store

System parameters for loading key store

Example