[id='credential-keystores']
:context: credential-keystores
= Storing {brandname} Server credentials in keystores

External services require credentials to authenticate with {brandname} Server.
To protect sensitive text strings such as passwords, add them to a credential keystore rather than directly in {brandname} Server configuration files.

You can then configure {brandname} Server to decrypt passwords for establishing connections with services such as databases or LDAP directories.

[IMPORTANT]
====
Plain-text passwords in `{server_home}/server/conf` are unencrypted.
Any user account with read access to the host filesystem can view plain-text passwords.

While credential keystores are password-protected store encrypted passwords, any user account with write access to the host filesystem can tamper with the keystore itself.

To completely secure {brandname} Server credentials, you should grant read-write access only to user accounts that can configure and run {brandname} Server.
====

include::{topics}/proc_setting_up_credential_keystores.adoc[leveloffset=+1]
include::{topics}/proc_securing_credential_keystores.adoc[leveloffset=+1]
include::{topics}/ref_credential_keystore_configuration.adoc[leveloffset=+1]
include::{topics}/ref_credential_keystore_references.adoc[leveloffset=+1]

// Restore the parent context.
ifdef::parent-context[:context: {parent-context}]
ifndef::parent-context[:!context:]
