Your achievements

Level 1

0% to

Level 2

Tip /
Sign in

Sign in to Community

to gain points, level up, and earn exciting badges like the new
Bedrock Mission!

Learn more

View all

Sign in to view all badges

SOLVED

Store and deploy secure OSGI configuration for OOTB AEM services

nemo7
Level 2
Level 2

Does AEM provide a way to store and deploy secure OSGI configuration(passwords)  for OOTB services?

I know about approach with com.adobe.granite.crypto.CryptoSupport (http://www.wemblog.com/2012/03/how-to-use-crypto-support-in-cq55.html), but unfortunately it doesn't work for OOTB services(e.g Day CQ Mail Service).

Currently, we just change configuration manually on production servers, but we would like to deploy it and store in the repository, and at the same time we don't want to store passwords in an open way.

Is there any way to do it or probably some best practices?

Thanks in advance!

1 Accepted Solution
MC_Stuff
Correct answer by
Level 9
Level 9

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

View solution in original post

0 Replies
smacdonald2008
Level 10
Level 10

If the values are in Adobe Felix - the idea is that the site is secure - to access it - you need a secure admin password. I am not aware of any other methods to secure the OSGi OOTB config services. 

MC_Stuff
Correct answer by
Level 9
Level 9

Hi Nemo,

   Till AEM 6.2 it was not supported. During my discussion with adobe product management OR in 6.3 it is made as oob option.  You can check through official support channel & mean time I will check my notes tommorow and will let you know if i find any thing.

Thanks,

nemo7
Level 2
Level 2

Hi Smacdonald,

Thanks for the reply. Yes, the OSGI console secure, but usually configuration deployed with the source code and we don't want to store it in an open way inside the GIT.

Best regards,

Andrii

25793466
Level 2
Level 2

It appears this indeed is available starting in 6.3.  From the 6.3 release notes: "Support for all OSGI configuration properties to be stored in a protected encrypted form instead of clear text."  How do you enable this or is it done automatically?

What I am really looking for is the LDAP Identity Provider bind password to be masked when I view through the CRX.  In 6.3, I am still seeing it in clear text.  Perhaps that's not what this feature is intended to do.

Shelly_Goel
Level 1
Level 1

Hi Nemo,

How did you finally implement this for storing values in GIT? I understand values can be obscured in felix console.

Thanks

Shelly