Class FilePasswordProvider

java.lang.Object
org.apache.logging.log4j.core.net.ssl.FilePasswordProvider
All Implemented Interfaces:
PasswordProvider

class FilePasswordProvider extends Object implements PasswordProvider
PasswordProvider that reads password from a file.

This is a relatively secure way to handle passwords:

  • Managing file access privileges can be delegated to the operating system.
  • The password file can be in a separate location from the logging configuration. This gives flexibility to have different passwords in different environments while using the same logging configuration. It also allows for separation of responsibilities: developers don't need to know the password that is used in the production environment.
  • There is only a small window of opportunity for attackers to obtain the password from a memory dump: the password data is only resident in memory from the moment the caller calls the getPassword() method and the password file is read until the moment that the caller completes authentication and overwrites the password char[] array.

Less secure implementations are MemoryPasswordProvider and EnvironmentPasswordProvider.

  • Field Details

    • passwordPath

      private final Path passwordPath
  • Constructor Details

    • FilePasswordProvider

      public FilePasswordProvider(String passwordFile) throws NoSuchFileException
      Constructs a new FilePasswordProvider with the specified path.
      Parameters:
      passwordFile - the path to the password file
      Throws:
      NoSuchFileException - if the password file does not exist when this FilePasswordProvider is constructed
  • Method Details

    • getPassword

      public char[] getPassword()
      Description copied from interface: PasswordProvider
      Returns a new char[] array with the password characters.

      It is the responsibility of the caller to erase this data by calling Arrays.fill(char[], char) immediately when authentication is complete and the password data is no longer needed.

      Specified by:
      getPassword in interface PasswordProvider
      Returns:
      a copy of the password