> ## Documentation Index
> Fetch the complete documentation index at: https://aletyx.ai/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Securing password using key store

> Store KIE Server passwords in a key store instead of clear text on the disk and use them in the application.

KIE Server uses basic authentication with passwords for some communication (e.g. the REST API). From a security perspective, it is not safe to store such passwords in clear text form on the disk. For this purpose, a mechanism was developed to store passwords in a key store and then use them in the application.

## Simple use case

A user wants to secure the password used for communicating via the REST client. The user creates a new keystore to hold the password and sets up system variables with the keystore information; KIE then automatically loads the keystore and uses the stored password to secure the communication.

## Implementation and business logic

The current implementation uses the key store if it is defined. If not, the functionality falls back to the old behavior of using configuration parameters.

## System requirements

To use a key store, you need to create it first. As JKS does not support symmetric keys, you have to create a JCEKS key store. Moreover, a password can be stored in a key store only for Java 8 and above. To generate a key store, you can use the standard KeyTool utility, which is part of the JDK installation. {/* TODO: Review this */}

## Initialization of a key store

For keystore initialization, we recommend using keytool. The syntax is the following:

```bash theme={null}
${JAVA_HOME}/bin/keytool -importpassword -keystore _keystore_url_ -keypass _alias_key_password_ -alias _password_alias_ -storepass _keystore_password_ -storetype JCEKS
```

* **alias** - alias name of the entry to process

* **keypass** - key password

* **keystore** - keystore name

* **storepass** - keystore password

* **storetype** - keystore type

After running this command, you will be asked to enter the password that you want to store.

## System parameters for loading key store

* **kie.keystore.keyStoreURL** - URL to a keystore which should be used

* **kie.keystore.keyStorePwd** - password to a keystore

* **kie.keystore.key.server.alias** - alias of the key for REST services where password is stored

* **kie.keystore.key.server.pwd** - password of an alias for REST services with stored password

* **kie.keystore.key.ctrl.alias** - alias of the key for default REST jBPM controller where password is stored

* **kie.keystore.key.ctrl.pwd** - password of an alias for default REST jBPM controller with stored password

## Example

1. Create a user and password in the application server (it must have the kie-server role).

   ```bash theme={null}
   $ ./bin/jboss-cli.sh --commands="embed-server --std-out=echo,/subsystem=elytron/filesystem-realm=ApplicationRealm:add-identity(identity=kieserver),/subsystem=elytron/filesystem-realm=ApplicationRealm:set-password(identity=kieserver, clear={password='kiePassword1!'}),/subsystem=elytron/filesystem-realm=ApplicationRealm:add-identity-attribute(identity=kieserver, name=role, value=['kie-server'])"
   ```

2. Use keytool to create a keystore with the password in it.

   ```bash theme={null}
   ${JAVA_HOME}/bin/keytool -importpassword -keystore /home/kie/keystores/droolsServer.jceks -keypass keypwd -alias droolsKey -storepass serverpwd -storetype JCEKS

   Enter the password to be stored:
   Re-enter password:

   ${JAVA_HOME}/bin/keytool -importpassword -keystore /home/kie/keystores/droolsServer.jceks -keypass keypwd -alias restKey -storepass serverpwd -storetype JCEKS

   Enter the password to be stored:
   Re-enter password:
   ```

3. Set the following system properties on the application server that will let KIE Server or the jBPM controller read the password from the keystore.

   ```xml theme={null}
       <system-properties>
           <property name="kie.keystore.keyStoreURL" value="file:///home/kie/keystores/droolsServer.jceks"/>
           <property name="kie.keystore.keyStorePwd" value="serverpwd"/>
           <property name="kie.keystore.key.server.alias" value="restKey"/>
           <property name="kie.keystore.key.server.pwd" value="keypwd"/>
           <property name="kie.keystore.key.ctrl.alias" value="droolsKey"/>
           <property name="kie.keystore.key.ctrl.pwd" value="keypwd"/>
       </system-properties>
   ```

4. Start the server to verify the configuration.