[id='server_credentials']
:context: credential-keystore
= Storing {brandname} Server Credentials in Keystores
External services require credentials to authenticate with {brandname} Server.
To protect sensitive text strings such as passwords, add them to a credential keystore rather than directly in {brandname} Server configuration files.

You can then configure {brandname} Server to decrypt passwords for establishing connections with services such as databases or LDAP directories.

[IMPORTANT]
====
Plain-text passwords in `{server_home}/server/conf` are unencrypted.
Any user account with read access to the host filesystem can view plain-text passwords.

While credential keystores are password-protected store encrypted passwords, any user account with write access to the host filesystem can tamper with the keystore itself.

To completely secure {brandname} Server credentials, you should grant read-write access only to user accounts that can configure and run {brandname} Server.
====

include::{topics}/proc_server_credentials.adoc[leveloffset=+1]
include::{topics}/ref_server_credentials.adoc[leveloffset=+1]

// Restore the parent context.
ifdef::parent-context[:context: {parent-context}]
ifndef::parent-context[:!context:]
