We have a WebLogic server (WLS_APP) with a lot of web applications, we also have an Oracle Service Bus (WLS_OSB) with a lot of services deployed on it.

We have these services aggregated in proxy services with wss_authentication enabled. So each application that resides in WLS_APP needs a user/password in order to call services in WLS_OSB.

We think the easiest way to do this is to store the passwords of the application in a file in the WLS_APP server and then send it with the password to the OSB.

What is the best option to store these passwords in the WLS_APP?

  • 2
    What attack scenarios do you consider likely?
    – Philipp
    Sep 24, 2015 at 12:00
  • 1
    we (security group) will create the pair user/password and we want nobody more (System administrators, WebServer administrators, developers) could see the password. Sep 24, 2015 at 12:43
  • 1
    Have you looked at SSO solutions like SAML? It might achieve what you want without requiring password storage (always risky}. Sep 24, 2015 at 14:37
  • We dont need SSO, we just whant to authenticate the aplication that resides in WLS_APP with the proxy service that resides in the OSB, witch have the authentication policy enables for that proxy service. I think SAML will not fit our requierements. But thx Sep 24, 2015 at 14:49
  • Ahh. I misread the question @DavidHerrero. It's the apps that need to authenticate. Yes. SAML doesn't seem to help. Sep 24, 2015 at 18:30

1 Answer 1


You want a password vault or password management solution that allows for application passwords, such as CyberArk Vault:


Then your application calls the vault API to securely retrieve passwords from the vault.

  • A quick scan of that site doesn't seem to go into details, so... do you know how they (or similar products) get around the problem that – presumably – the OP's application will need to authenticate itself with the "vault", and – again presumably – those credentials will need to be stored about as accessibly as the original passwords?
    – TripeHound
    Jun 7, 2019 at 8:22
  • 1
    Specific product recommendations are off topic as they become obsolete quickly.
    – A. Hersean
    Jun 7, 2019 at 8:35
  • 2
    @A.Hersean I agree, but in this particular case the specific product is only used as an example to illustrate what is meant. The answer focuses on a product type ("password vault or password management solution that allows for application passwords").
    – freginold
    Sep 10, 2019 at 13:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .