Store and deploy secure OSGI configuration for OOTB AEM services | Community
Skip to main content
N
nemo7
Level 2
May 8, 2017
Solved

Store and deploy secure OSGI configuration for OOTB AEM services

  • May 8, 2017
  • 5 replies
  • 3559 views

Does AEM provide a way to store and deploy secure OSGI configuration(passwords)  for OOTB services?

I know about approach with com.adobe.granite.crypto.CryptoSupport (http://www.wemblog.com/2012/03/how-to-use-crypto-support-in-cq55.html), but unfortunately it doesn't work for OOTB services(e.g Day CQ Mail Service).

Currently, we just change configuration manually on production servers, but we would like to deploy it and store in the repository, and at the same time we don't want to store passwords in an open way.

Is there any way to do it or probably some best practices?

Thanks in advance!

This post is no longer active and is closed to new replies. Need help? Start a new post to ask your question.
Best answer by MC_Stuff

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

5 replies

smacdonald2008
smacdonald2008
Level 10
May 9, 2017

If the values are in Adobe Felix - the idea is that the site is secure - to access it - you need a secure admin password. I am not aware of any other methods to secure the OSGi OOTB config services. 

MC_Stuff
MC_StuffAccepted solution
Level 10
May 10, 2017

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

N
nemo7Author
Level 2
May 16, 2017

Hi Smacdonald,

Thanks for the reply. Yes, the OSGI console secure, but usually configuration deployed with the source code and we don't want to store it in an open way inside the GIT.

Best regards,

Andrii

2
25793466
Level 2
August 1, 2018

It appears this indeed is available starting in 6.3.  From the 6.3 release notes: "Support for all OSGI configuration properties to be stored in a protected encrypted form instead of clear text."  How do you enable this or is it done automatically?

What I am really looking for is the LDAP Identity Provider bind password to be masked when I view through the CRX.  In 6.3, I am still seeing it in clear text.  Perhaps that's not what this feature is intended to do.

S
Shelly_Goel
October 25, 2018

Hi Nemo,

How did you finally implement this for storing values in GIT? I understand values can be obscured in felix console.

Thanks

Shelly

Terms & ConditionsAccessibility statement

Loading footer...