1

We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it.

We have these services aggregated in proxy services with wss_authentication enabled. So each application that resides in WLS_APP needs a user/password in order to call services in WLS_OSB.

We think the easiest way to do this is to store the passwords of the application in a file in the WLS_APP server and then send it with the password to the OSB.

What is the best option to store these passwords in the WLS_APP?

Improve this question
5
  • 2
    What attack scenarios do you consider likely?
    – Philipp
    Commented Sep 24, 2015 at 12:00
  • 1
    we (security group) will create the pair user/password and we want nobody more (System administrators, WebServer administrators, developers) could see the password.
    – David Herrero
    Commented Sep 24, 2015 at 12:43
  • 1
    Have you looked at SSO solutions like SAML? It might achieve what you want without requiring password storage (always risky}.
    – Neil Smithline
    Commented Sep 24, 2015 at 14:37
  • We dont need SSO, we just whant to authenticate the aplication that resides in WLS_APP with the proxy service that resides in the OSB, witch have the authentication policy enables for that proxy service. I think SAML will not fit our requierements. But thx
    – David Herrero
    Commented Sep 24, 2015 at 14:49
  • Ahh. I misread the question @DavidHerrero. It's the apps that need to authenticate. Yes. SAML doesn't seem to help.
    – Neil Smithline
    Commented Sep 24, 2015 at 18:30

1 Answer 1

Reset to default
-1

You want a password vault or password management solution that allows for application passwords, such as CyberArk Vault:

https://www.cyberark.com/solutions/by-project/application-credential-security/

Then your application calls the vault API to securely retrieve passwords from the vault.

Improve this answer
3
  • A quick scan of that site doesn't seem to go into details, so... do you know how they (or similar products) get around the problem that – presumably – the OP's application will need to authenticate itself with the "vault", and – again presumably – those credentials will need to be stored about as accessibly as the original passwords?
    – TripeHound
    Commented Jun 7, 2019 at 8:22
  • 1
    Specific product recommendations are off topic as they become obsolete quickly.
    – A. Hersean
    Commented Jun 7, 2019 at 8:35
  • 2
    @A.Hersean I agree, but in this particular case the specific product is only used as an example to illustrate what is meant. The answer focuses on a product type ("password vault or password management solution that allows for application passwords").
    – freginold
    Commented Sep 10, 2019 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .