Expand my Community achievements bar.

Dive into Adobe Summit 2024! Explore curated list of AEM sessions & labs, register, connect with experts, ask questions, engage, and share insights. Don't miss the excitement.
SOLVED

Store and deploy secure OSGI configuration for OOTB AEM services

Avatar

Level 2

Does AEM provide a way to store and deploy secure OSGI configuration(passwords)  for OOTB services?

I know about approach with com.adobe.granite.crypto.CryptoSupport (http://www.wemblog.com/2012/03/how-to-use-crypto-support-in-cq55.html), but unfortunately it doesn't work for OOTB services(e.g Day CQ Mail Service).

Currently, we just change configuration manually on production servers, but we would like to deploy it and store in the repository, and at the same time we don't want to store passwords in an open way.

Is there any way to do it or probably some best practices?

Thanks in advance!

1 Accepted Solution

Avatar

Correct answer by
Level 9

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

View solution in original post

5 Replies

Avatar

Level 10

If the values are in Adobe Felix - the idea is that the site is secure - to access it - you need a secure admin password. I am not aware of any other methods to secure the OSGi OOTB config services. 

Avatar

Correct answer by
Level 9

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

Avatar

Level 2

Hi Smacdonald,

Thanks for the reply. Yes, the OSGI console secure, but usually configuration deployed with the source code and we don't want to store it in an open way inside the GIT.

Best regards,

Andrii

Avatar

Level 2

It appears this indeed is available starting in 6.3.  From the 6.3 release notes: "Support for all OSGI configuration properties to be stored in a protected encrypted form instead of clear text."  How do you enable this or is it done automatically?

What I am really looking for is the LDAP Identity Provider bind password to be masked when I view through the CRX.  In 6.3, I am still seeing it in clear text.  Perhaps that's not what this feature is intended to do.

Avatar

Level 1

Hi Nemo,

How did you finally implement this for storing values in GIT? I understand values can be obscured in felix console.

Thanks

Shelly