--- title: "Encrypt the Lasernet Keep Datasource Password" slug: "encrypt-the-lasernet-keep-datasource-password" description: "This page describes how to configure Lasernet Keep to store its datasource connection password in an encrypted format." tags: ["Autoform DM", "Security"] updated: 2026-04-21T09:47:05Z published: 2026-04-21T09:47:05Z canonical: "kb.lasernetgroup.com/encrypt-the-lasernet-keep-datasource-password" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.lasernetgroup.com/llms.txt > Use this file to discover all available pages before exploring further. # Encrypt the Lasernet Keep Datasource Password By default, the password that Keep uses to connect to its datasource is stored as cleartext. To mitigate this security risk, Keep can store an encrypted password. This ensures that the password is not revealed when Keep configuration files are viewed or shared. > [!NOTE] > Note > > A Keep system’s datasource is a database, so the subject of this guide is the database connection password. > [!NOTE] > Note > > This guide applies only to Keep systems running in standalone mode. In summary, the implementation process for encrypting the Keep datasource password is: 1. [Complete prerequisite steps](/v1/docs/encrypt-the-lasernet-keep-datasource-password#prerequisite-steps). 2. [Install the custom Wildfly login module](/v1/docs/encrypt-the-lasernet-keep-datasource-password#install-the-custom-wildfly-login-module). 3. [Generate an encrypted password](/v1/docs/encrypt-the-lasernet-keep-datasource-password#generate-an-encrypted-password). 4. [Configure Keep](/v1/docs/encrypt-the-lasernet-keep-datasource-password#configure-keep). 5. [Start Keep](/v1/docs/encrypt-the-lasernet-keep-datasource-password#start-keep). The steps are described in detail below. ## Prerequisite Steps ### Download the Required Files To implement datasource password encryption, you will need the following components: - `efs-pbetool.jar`: A CLI tool that encrypts the password. - `pbeloginmodule-1.0.1-module.zip`: A ZIP archive that contains the Wildfly module that decrypts the password at runtime. These components are packaged into a single ZIP file. This package includes PbeLoginModule-1.0.1. [https://lngsupportdownloads.blob.core.windows.net/autoformdm/Tools/pbeloginmodule-1.0.1-dist.zip](https://lngsupportdownloads.blob.core.windows.net/autoformdm/Tools/pbeloginmodule-1.0.1-dist.zip) ### Back Up the Current Keep Configuration File Locate the `standalone.xml` Keep configuration file and make a backup copy of it. This file is in the `\standalone\configuration` directory of the Wildfly application server. For example, if Keep is installed to create a node named Production and it is installed to its default location, the configuration file is `C:\Program Files\Formpipe Software\Lasernet Keep\Server_11.0 - Production\wildfly-22.0.1.Final\standalone\configuration\standalone.xml`. ## Install the Custom Wildfly Login Module To install the password decryption module: 1. Open the ZIP file that you downloaded and then find `pbeloginmodule-1.0.1-module.zip` within it. 2. Extract `pbeloginmodule-1.0.1-module.zip` to the `modules` directory of the Wildfly application server. > [!NOTE] > Note > > For example, if Keep is installed to create a node named Production and it is installed to its default location, unpack the ZIP file’s contents to `C:\Program Files\Formpipe Software\Lasernet Keep\Server_11.0 - Production\wildfly-22.0.1.Final\modules\`. The Wildfly application server’s directory structure will now include a `\modules\com\formpipe\tools\main` directory. ## Generate an Encrypted Password In summary, during this part of the process you use the `efs-pbetool` CLI tool to encrypt the password. After the tool outputs the encrypted password, make a note of it because you will need the encrypted password during the next stage of this process. 1. Open the ZIP file that you downloaded and then extract `efs-pbetool.jar` from it. 2. Depending on whether you want to use the default encryption key or you want to provide one, follow the instructions in the appropriate following section: > [!NOTE] > Note > > In the commands in the following sections, substitute `<db-password>` for the datasource password. - [Use the Default Key to Encrypt the Password](/v1/docs/encrypt-the-lasernet-keep-datasource-password#use-the-default-key-to-encrypt-the-password) - [Use a Provided Key to Encrypt the Password](/v1/docs/encrypt-the-lasernet-keep-datasource-password#use-a-provided-key-to-encrypt-the-password) 3. Make a note of the encrypted password that `efs-pbetool.jar` generates. ### Use the Default Key to Encrypt the Password Run the following command: `java -jar efs-pbetool.jar <db-password>` ### Use a Provided Key to Encrypt the Password If you want to provide your own encryption key to encrypt the password (instead of using the default key), follow these steps: 1. Generate the key value that you want to use. 2. Add the key to a file named `encryption.key`. 3. Run the following command. Substitute `<path to encryption.key file>` for the path to the `encryption.key` file that you created. `java -jar efs-pbetool.jar <db-password> <path to encryption.key file>` > [!NOTE] > Note > > The path must be an absolute path that contains / (forward slashes). UNC paths are not supported. ## Configure Keep This part of the process adds the encrypted password to the Keep configuration and configures Keep to decrypt the password. Locate `Readme.md` in `pbeloginmodule-1.0.1-dist.zip` and follow the instructions in the `### Modify the datasource configuration` part of that file. The process involves running a script that makes the necessary changes to Keep. ## Start Keep Start Keep. It will read the encrypted password from the configuration file, decrypt it, and then use the password to connect to the datasource. ## Troubleshooting and Rollback If you encounter any issues, check the server logs for relevant messages. If necessary, use the backup of the unmodified `standalone.xml` file to revert the configuration changes.