Securing credentials/passwords not possible with Quarkus distribution

Describe the bug

It seems there is currently no way to secure/hide/obfuscate any of the passwords (i.e. db-password, https-key-store-password, https-trust-store-password, referenced in https://www.keycloak.org/server/all-config).

With Wildfly one could use Elytron encrypted values and “credential-stores”.

This is an issue because, as @FX-Liagre points out in the referenced discussions

[…]And our customers’ security guys (and DB admins…) tend to faint when you present them a config text file with clear text DB credentials… 😦

Version

17.0.0

Expected behavior

Have some sort of encryption ready for hiding credentials or passwords.

Actual behavior

No such feature available in Quarkus, but still is in Wildfly.

How to Reproduce?

Provide any clear-text passwords inside the keycloak.conf. Find someone who does a security scan on the installation -> they will find the clear-text password and might possibly faint over it

Anything else?

See also Discussion: https://github.com/keycloak/keycloak/discussions/10595

[dfs-]

Hi @pedroigor,

thanks for looking at this issue. In my current environment I am using Windows (duh) and am not using a container. Currently, as opposed to wildfly there is no standard way of running Keycloak as a service I am using NSSM (https://nssm.cc/) as a lightweight service wrapper for Keycloak.

While NSSM supports custom environment variables to be set only inside it’s “sandbox” at least in Windows it is trivial to retrieve the information using Sysinternals Process Explorer:

The screenshot is from a testing server, so please ignore any nonsensical stuff you might see on the screenshot. 😃

[pedroigor]

@dfs- Not at all 😃 It means it was added to our backlog. The next step is to discuss with the team how/when it should be implemented.