Previous Next JavaScript must be enabled to correctly display this content

## Password store file

A password store file is a mechanism used to securely store sensitive information such as passwords that are required for authentication and secure communication. This mechanism is available in the Community and Enterprise Edition versions of Oracle NoSQL Database. The password store file is an unencrypted file. It is read-protected to prevent unauthorized access.

If you want to use a password store file to store your passwords, you must specify password file (`pwdfile`) as the password management mechanism while configuring the store security using the `securityconfig` utility or `makebootconfig` utility.

The following steps show you how this can be done.

- Using `securityconfig`:
  Run the `securityconfig` utility to set up the basic store configuration with security. For more information on the `securityconfig` utility, see Configuring Security with Securityconfig.

      java -Xmx64m -Xms64m -jar $KVHOME/lib/kvstore.jar securityconfig

  Use the `config create` command with the `-pwdmgr` option to specify the password management mechanism. In this case, the mechanism is `pwdfile`.

      security-> config create -pwdmgr pwdfile -root $KVROOT
      Enter a password for the Java KeyStore:

- Using `makebootconfig`:
  Run the `makebootconfig` utility with `-store-security configure` option. For more information on the `makebootconfig` utility, see Configuring Security with Makebootconfig. For example:

      java -Xmx64m -Xms64m \
      -jar KVHOME/lib/kvstore.jar makebootconfig \
      -root KVROOT -port 5000 \
      -host node01 -harange 5010,5020 \
      -store-security configure -pwdmgr pwdfile -capacity 3

      Enter a password for the Java KeyStore:

Enter a password for your store and then re-enter it for verification. The configuration tool generates the security related files. The file `store.passwd` is the password store file that contains the keystore access password. It contains secret information that should be known only to the server processes. The file should should remain on the server side.

The `client.security` and `client.trust` files should be copied to the client and used when connecting to the data store.

    Created files
        $KVROOT/security/store.keys
        $KVROOT/security/store.trust
        $KVROOT/security/client.trust
        $KVROOT/security/client.security
        $KVROOT/security/store.passwd
        $KVROOT/security/security.xml
    Created

You can create and manipulate password store files to store user passwords. User passwords are required to authenticate individual users or clients to the database for data access and operations based on the privileges granted to them.

The following commands show you how this can be done.

To create a new password store file, run the `pwdfile create` command:

    pwdfile create -file <password store file>

For example:

    security-> pwdfile create -file $KVROOT/security/login.pwd
    Created

To manipulate secrets (passwords), which are associated with a name (alias), run the `pwdfile secret` command:

    pwdfile secret -file <password store file>
    {-set | -delete} -alias <alias>

If the user specifies the `-set` option, the user is prompted for a new password for the specified alias and required to verify the new password.

If the `-delete` option is specified, the alias is deleted from the store.

For example, to manipulate the secret (password) associated with user John, run the `pwdfile` secret command as follows:

    security-> pwdfile secret -file $KVROOT/security/login.pwd -set -alias John
    Enter the secret value to store: <password for user John>
    Re-enter the secret value for verification: <password for user John>
    Secret created

In order to authenticate as a user, you must provide the user name and the password file as security properties while connecting to the data store. To do this, create a copy of the `client.security` file present in the `security` folder that was created earlier. The `client.security` file contains the security properties and configuration details required for clients to securely connect to the data store. In the copied file, include additional properties containing the user name and the password file.

The following steps show you how this can be done.

Make a copy of the `client.security` file present in the `security` folder. Let us call it `user.login`.

    cp client.security user.login

Include the following additional properties in `user.login` file:

    oracle.kv.auth.username=John
    oracle.kv.auth.pwdfile.file=$KVROOT/security/login.pwd

Now, you can use `user.login` to securely connect to the store as user John:

    java -Xmx64m -Xms64m -jar lib/kvstore.jar runadmin -port 8000 -host localhost -security kvroot/security/user.login
    Logged in to Admin as John
    kv->