Configure "Secure Vault" to secure plain text passwords in WSO2 config files

If we take a WSO2 product, there are so many config files which contains plain text passwords. This blog post explains how we can secure those passwords.

Let's take WSO2 DAS . analytics-datasource.xml file and secure the password in following configuration.

	<datasource>
	<name>WSO2_ANALYTICS_EVENT_STORE_DB</name>
	<description>The datasource used for analytics record store</description>
	<definition type="RDBMS">
	<configuration>
	<url>jdbc:mysql://localhost:3306/das_event_store?autoReconnect=true</url>
	<username>das_event_store</username>
	<password>das_event_store_password</password>
	<driverClassName>com.mysql.jdbc.Driver</driverClassName>
	<maxActive>50</maxActive>
	<maxWait>60000</maxWait>
	<validationQuery>SELECT 1</validationQuery>
	<defaultAutoCommit>false</defaultAutoCommit>
	<initialSize>0</initialSize>
	<testWhileIdle>true</testWhileIdle>
	<minEvictableIdleTimeMillis>4000</minEvictableIdleTimeMillis>
	</configuration>
	</definition>
	</datasource>

view raw WSO2_config_3 hosted with ❤ by GitHub

Step 1:
Go to <WSO2_DAS>/repository/conf/security and add the following line to the cipher-tool.properties file

Datasources.WSO2_ANALYTICS_EVENT_STORE_DB.Configuration.Password=repository/conf/datasources/analytics-datasources.xml//datasources-configuration/datasources/datasource[name='WSO2_ANALYTICS_EVENT_STORE_DB']/definition[@type='RDBMS']/configuration/password,true

view raw WSO2_config_4 hosted with ❤ by GitHub

Create alias with file path, xpath to the element and boolean value true.

Step 2:
Add the following line to the cipher-text.properties file.

Datasources.WSO2_ANALYTICS_EVENT_STORE_DB.Configuration.Password=[das_event_store_password]

view raw WSO2_config_5 hosted with ❤ by GitHub

You have to provide the alias with the plain text password

Step 3:
Go to <WSO2_DAS>/bin and execute ./ciphertool.sh -Dconfigure

This will,
- Encrypt the password defined in cipher-text.properties file
- Configure the analytics-datasauces.xml as follows

	<datasource>
	<name>WSO2_ANALYTICS_EVENT_STORE_DB</name>
	<description>The datasource used for analytics record store</description>
	<definition type="RDBMS">
	<configuration>
	<url>jdbc:mysql://localhost:3306/das_event_store?autoReconnect=true</url>
	<username>das_event_store</username>
	<password svns:secretAlias="Datasources.WSO2_ANALYTICS_EVENT_STORE_DB.Configuration.Password">password</password>
	<driverClassName>com.mysql.jdbc.Driver</driverClassName>
	<maxActive>50</maxActive>
	<maxWait>60000</maxWait>
	<validationQuery>SELECT 1</validationQuery>
	<defaultAutoCommit>false</defaultAutoCommit>
	<initialSize>0</initialSize>
	<testWhileIdle>true</testWhileIdle>
	<minEvictableIdleTimeMillis>4000</minEvictableIdleTimeMillis>
	</configuration>
	</definition>
	</datasource>

view raw WSO2_config_6 hosted with ❤ by GitHub

Step 4: Restart the server.

How to change a password

Configure cipher-text.properties file with the password you want to change.  You need to remove the encrypted value and replace it with plain text password with  [ ] square brackets.
Execute the ./ciphertool.sh -Dconfigure
Start the server.