How to securely store credentials in Liferay 7.4 (not in plaintext)

General
1

Liferay 7.4 CE, Tomcat bundle, on an Ubuntu server.

Right now our credentials (DB password,3rd party secrets ) are sitting in plaintext — in portal-ext.properties , env variables

I want to store these more securely on the server without plaintext exposure.

Questions:

  1. Does Liferay provide any built-in way to encrypt or protect config values (e.g. jdbc.default.password instead of storing them in plaintext?
  2. Is there a supported mechanism for encrypted/obfuscated property values or a secrets/vault integration in CE?

Looking for the recommended Liferay-native approach to avoid plaintext credentials on the server.

1 Answer

1
2

Liferay does not support encrypting JDBC passwords.

You can however protect them in the following ways:

  1. Use JNDI. This just hands. Liferay a connection, so the credentials are never exposed to the application.
  2. Use permissions. The user that starts tomcat? That should be a special user, i.e. tomcat, and only that user should have read permission on the file(s) with the jndi credentials.
  3. Use a vault/sidecar to make credentials in JNDI config available in a k8s/docker startup.