Chapter 7. Storing Data Grid Server credentials in keystores External services require credentials to authenticate with Data Grid Server. To protect sensitive text strings such as passwords, add them to a credential keystore rather than directly in Data Grid Server configuration files. You can then configure Data Grid Server to decrypt passwords for establishing connections with services such as databases or LDAP directories. Important Plain-text passwords in USDRHDG_HOME/server/conf are unencrypted. Any user account with read access to the host filesystem can view plain-text passwords. While credential keystores are password-protected store encrypted passwords, any user account with write access to the host filesystem can tamper with the keystore itself. To completely secure Data Grid Server credentials, you should grant read-write access only to user accounts that can configure and run Data Grid Server. 7.1. Setting up credential keystores Create keystores that encrypt credential for Data Grid Server access. A credential keystore contains at least one alias that is associated with an encrypted password. After you create a keystore, you specify the alias in a connection configuration such as a database connection pool. Data Grid Server then decrypts the password for that alias from the keystore when the service attempts authentication. You can create as many credential keystores with as many aliases as required. Note As a security best practice, keystores should be readable only by the user who runs the process for Data Grid Server. Procedure Open a terminal in USDRHDG_HOME . Create a keystore and add credentials to it with the credentials command. Tip By default, keystores are of type PKCS12. Run help credentials for details on changing keystore defaults. The following example shows how to create a keystore that contains an alias of "dbpassword" for the password "changeme". When you create a keystore you also specify a password to access the keystore with the -p argument. Linux Microsoft Windows Check that the alias is added to the keystore. Open your Data Grid Server configuration for editing. Configure Data Grid to use the credential keystore. Add a credential-stores section to the security configuration. Specify the name and location of the credential keystore. Specify the password to access the credential keystore with the clear-text-credential configuration. Note Instead of adding a clear-text password for the credential keystore to your Data Grid Server configuration you can use an external command or masked password for additional security. You can also use a password in one credential store as the master password for another credential store. Reference the credential keystore in configuration that Data Grid Server uses to connect with an external system such as a datasource or LDAP server. Add a credential-reference section. Specify the name of the credential keystore with the store attribute. Specify the password alias with the alias attribute. Tip Attributes in the credential-reference configuration are optional. store is required only if you have multiple keystores. alias is required only if the keystore contains multiple password aliases. Save the changes to your configuration. 7.2. Securing passwords for credential keystores Data Grid Server requires a password to access credential keystores. You can add that password to Data Grid Server configuration in clear text or, as an added layer of security, you can use an external command for the password or you can mask the password. Prerequisites Set up a credential keystore for Data Grid Server. Procedure Do one of the following: Use the credentials mask command to obscure the password, for example: Masked passwords use Password Based Encryption (PBE) and must be in the following format in your Data Grid Server configuration: <MASKED_VALUE;SALT;ITERATION>. Use an external command that provides the password as standard output. An external command can be any executable, such as a shell script or binary, that uses java.lang.Runtime#exec(java.lang.String) . If the command requires parameters, provide them as a space-separated list of strings. 7.3. Credential keystore configuration You can add credential keystores to Data Grid Server configuration and use clear-text passwords, masked passwords, or external commands that supply passwords. Credential keystore with a clear text password XML <server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> </security> </server> JSON { "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }] } } } YAML server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!" Credential keystore with a masked password XML <server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <masked-credential masked="1oTMDZ5JQj6DVepJviXMnX;pepper99;100"/> </credential-store> </credential-stores> </security> </server> JSON { "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "masked-credential": { "masked": "1oTMDZ5JQj6DVepJviXMnX;pepper99;100" } }] } } } YAML server: security: credentialStores: - name: credentials path: credentials.pfx maskedCredential: masked: "1oTMDZ5JQj6DVepJviXMnX;pepper99;100" External command passwords XML <server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <command-credential command="/path/to/executable.sh arg1 arg2"/> </credential-store> </credential-stores> </security> </server> JSON { "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "command-credential": { "command": "/path/to/executable.sh arg1 arg2" } }] } } } YAML server: security: credentialStores: - name: credentials path: credentials.pfx commandCredential: command: "/path/to/executable.sh arg1 arg2" 7.4. Credential keystore references After you add credential keystores to Data Grid Server you can reference them in connection configurations. Datasource connections XML <server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> </security> <data-sources> <data-source name="postgres" jndi-name="jdbc/postgres"> <!-- Specifies the database username in the connection factory. --> <connection-factory driver="org.postgresql.Driver" username="dbuser" url="USD{org.infinispan.server.test.postgres.jdbcUrl}"> <!-- Specifies the credential keystore that contains an encrypted password and the alias for it. --> <credential-reference store="credentials" alias="dbpassword"/> </connection-factory> <connection-pool max-size="10" min-size="1" background-validation="1000" idle-removal="1" initial-size="1" leak-detection="10000"/> </data-source> </data-sources> </server> JSON { "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }], "data-sources": [{ "name": "postgres", "jndi-name": "jdbc/postgres", "connection-factory": { "driver": "org.postgresql.Driver", "username": "dbuser", "url": "USD{org.infinispan.server.test.postgres.jdbcUrl}", "credential-reference": { "store": "credentials", "alias": "dbpassword" } } }] } } } YAML server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!" dataSources: - name: postgres jndiName: jdbc/postgres connectionFactory: driver: org.postgresql.Driver username: dbuser url: 'USD{org.infinispan.server.test.postgres.jdbcUrl}' credentialReference: store: credentials alias: dbpassword LDAP connections XML <server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> <security-realms> <security-realm name="default"> <!-- Specifies the LDAP principal in the connection factory. --> <ldap-realm name="ldap" url="ldap://my-ldap-server:10389" principal="uid=admin,ou=People,dc=infinispan,dc=org"> <!-- Specifies the credential keystore that contains an encrypted password and the alias for it. --> <credential-reference store="credentials" alias="ldappassword"/> </ldap-realm> </security-realm> </security-realms> </security> </server> JSON { "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }], "security-realms": [{ "name": "default", "ldap-realm": { "name": "ldap", "url": "ldap://my-ldap-server:10389", "principal": "uid=admin,ou=People,dc=infinispan,dc=org", "credential-reference": { "store": "credentials", "alias": "ldappassword" } } }] } } } YAML server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!" securityRealms: - name: "default" ldapRealm: name: ldap url: 'ldap://my-ldap-server:10389' principal: 'uid=admin,ou=People,dc=infinispan,dc=org' credentialReference: store: credentials alias: ldappassword

Commands:
bin/cli.sh credentials add dbpassword -c changeme -p "secret1234!"
bin\cli.bat credentials add dbpassword -c changeme -p "secret1234!"
bin/cli.sh credentials ls -p "secret1234!" dbpassword
bin/cli.sh credentials mask -i 100 -s pepper99 "secret1234!"
<server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> </security> </server>
{ "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }] } } }
server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!"
<server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <masked-credential masked="1oTMDZ5JQj6DVepJviXMnX;pepper99;100"/> </credential-store> </credential-stores> </security> </server>
{ "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "masked-credential": { "masked": "1oTMDZ5JQj6DVepJviXMnX;pepper99;100" } }] } } }
server: security: credentialStores: - name: credentials path: credentials.pfx maskedCredential: masked: "1oTMDZ5JQj6DVepJviXMnX;pepper99;100"
<server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <command-credential command="/path/to/executable.sh arg1 arg2"/> </credential-store> </credential-stores> </security> </server>
{ "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "command-credential": { "command": "/path/to/executable.sh arg1 arg2" } }] } } }
server: security: credentialStores: - name: credentials path: credentials.pfx commandCredential: command: "/path/to/executable.sh arg1 arg2"
<server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> </security> <data-sources> <data-source name="postgres" jndi-name="jdbc/postgres"> <!-- Specifies the database username in the connection factory. --> <connection-factory driver="org.postgresql.Driver" username="dbuser" url="USD{org.infinispan.server.test.postgres.jdbcUrl}"> <!-- Specifies the credential keystore that contains an encrypted password and the alias for it. --> <credential-reference store="credentials" alias="dbpassword"/> </connection-factory> <connection-pool max-size="10" min-size="1" background-validation="1000" idle-removal="1" initial-size="1" leak-detection="10000"/> </data-source> </data-sources> </server>
{ "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }], "data-sources": [{ "name": "postgres", "jndi-name": "jdbc/postgres", "connection-factory": { "driver": "org.postgresql.Driver", "username": "dbuser", "url": "USD{org.infinispan.server.test.postgres.jdbcUrl}", "credential-reference": { "store": "credentials", "alias": "dbpassword" } } }] } } }
server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!" dataSources: - name: postgres jndiName: jdbc/postgres connectionFactory: driver: org.postgresql.Driver username: dbuser url: 'USD{org.infinispan.server.test.postgres.jdbcUrl}' credentialReference: store: credentials alias: dbpassword
<server xmlns="urn:infinispan:server:14.0"> <security> <credential-stores> <credential-store name="credentials" path="credentials.pfx"> <clear-text-credential clear-text="secret1234!"/> </credential-store> </credential-stores> <security-realms> <security-realm name="default"> <!-- Specifies the LDAP principal in the connection factory. --> <ldap-realm name="ldap" url="ldap://my-ldap-server:10389" principal="uid=admin,ou=People,dc=infinispan,dc=org"> <!-- Specifies the credential keystore that contains an encrypted password and the alias for it. --> <credential-reference store="credentials" alias="ldappassword"/> </ldap-realm> </security-realm> </security-realms> </security> </server>
{ "server": { "security": { "credential-stores": [{ "name": "credentials", "path": "credentials.pfx", "clear-text-credential": { "clear-text": "secret1234!" } }], "security-realms": [{ "name": "default", "ldap-realm": { "name": "ldap", "url": "ldap://my-ldap-server:10389", "principal": "uid=admin,ou=People,dc=infinispan,dc=org", "credential-reference": { "store": "credentials", "alias": "ldappassword" } } }] } } }
server: security: credentialStores: - name: credentials path: credentials.pfx clearTextCredential: clearText: "secret1234!" securityRealms: - name: "default" ldapRealm: name: ldap url: 'ldap://my-ldap-server:10389' principal: 'uid=admin,ou=People,dc=infinispan,dc=org' credentialReference: store: credentials alias: ldappassword