Securerly store the Web Console credentials for the boot-time configuration AEM 6.5 | Community
Skip to main content
A
anasustic
Level 6
July 10, 2026
Question

Securerly store the Web Console credentials for the boot-time configuration AEM 6.5

  • July 10, 2026
  • 6 replies
  • 101 views

Hi

 

We are not allowed to store the password in plain text on our instances under the following path:
crx-quickstart/install/org.apache.felix.webconsole.internal.servlet.OsgiManager.cfg.json.

We attempted to encrypt the password using /system/console/crypto  and replaced  the paintext value in the configuration with the new encrypted one. However, AEM does not appear to decrypt this value at startup and authenication falls back to the default admin/admin credentials.

 

Is there a supported way to securerly store the Web Console credentials for this boot-time configuration without using plaintext? 

If not, what is Adobe’s recommended approach for environments where plaintest passwords are prohibited?

Thanks!

6 replies

A
akhil_merupula
Level 4
July 10, 2026

Hi ​@anasustic,

 

The reason the encrypted value doesn’t work here is that OsgiManager.cfg.json is read by the Felix Web Console bundle before AEM’s crypto service is available at startup. The {encrypt} prefix decryption that works in regular OSGi configs relies on the Granite crypto bundle being active, but that’s too late in the boot sequence for this file.

 

The supported approach for AEM 6.5 on-prem is to use the admin.password.reset mechanism or configure credentials via the org.apache.felix.webconsole.internal.servlet.OsgiManager factory config through a Sling repo init script, which avoids the plaintext file entirely.

 

Practically speaking, Adobe’s recommendation for environments where plaintext is prohibited is to restrict filesystem access to crx-quickstart/install/ at the OS level (file permissions, vault/secrets manager) rather than relying on application-layer encryption for this particular config, since AEM cannot decrypt it early enough to use it.

 

If you’re on a hardened environment, raising this with Adobe Support is worth it as they may have a hotfix or documented approach for your specific 6.5 SP version.

A
anasusticAuthor
Level 6
July 13, 2026

Hi ​@akhil_merupula 

 

Thanks for your reply.

 

Placing a file named admin.password with the content admin.password=test inside the crx-quickinstall folder does not seem to work for an existing AEM 6.5 on-prem instance upon restart. 

Regarding  your suggestion  org.apache.felix.webconsole.internal.servlet.OsgiManager the admin.password is not used for the startup window or the OSGi Management Console if a WebConsoleSecurityProvider is configured for authentication. As per the documentation, "The password for the user allowed to access the OSGi Management Console. This property is ignored if a WebConsoleSecurityProvider is used for authentication."

 

A
akhil_merupula
Level 4
July 13, 2026

​@anasustic  Thanks for the additional context, that’s the crucial piece. If a WebConsoleSecurityProvider is registered (which AEM 6.5 does by default via Granite), the admin.password property in OsgiManager.cfg.json is completely bypassed. The Web Console delegates auth to Granite’s user management instead.

 

That means the credential is effectively controlled by the AEM repository user, not the Felix config file. So the secure approach is to manage the admin user password through AEM’s user management (or a service user) and protect the repository itself, not the Felix config file.

 

For compliance purposes, this is actually the better posture: the password never needs to live in a filesystem config at all.

TarunKumar
Community Advisor
TarunKumarCommunity Advisor
Community Advisor
July 13, 2026

Hi ​@anasustic ,


If there is a custom configuration and a need to use an encrypted password, we can use the concept of cryptosupport in AEM.

But there are few OSGi Configurations in AEM like “JDBC” and SAML We can use cryptosupport concept here too??
You can keep encrypted value in the “password fields”  directly in these configurations and for the decryption part, you don’t need to worry. AEM will take care of it.
 

You can follow below link for more details on it:

http://www.sgaemsolutions.com/2020/09/how-to-use-encrypted-password-for-ootb.html

 

-Tarun

Terms & ConditionsAccessibility statement

Loading footer...