Hello Guus,
I tested the configuration you recommended and came to the following:If I use embedded database, the encryption works fine, but if I use a Postgres database, the ldap admin password is still saved as plain text at the end of the deployment. The only change I made to the openfire.xml configuration was that I had to remove the database part from the autosetup part because the deployment could not find the database provider only if the database part was used outside of the autosetup.
<?xml version="1.0" encoding="UTF-8"?>
<jive>
<adminConsole>
<port>{{ .Values.openfire.adminConsole.httpPort }}</port>
<securePort>{{ .Values.openfire.adminConsole.httpsPort }}</securePort>
</adminConsole>
<connectionProvider>
<className>org.jivesoftware.database.DefaultConnectionProvider</className>
</connectionProvider>
<database>
<defaultProvider>
<driver>org.postgresql.Driver</driver>
<serverURL>jdbc:postgresql://{{ include "openfire.fullname" . }}-postgres:5432/openfire</serverURL>
<username>openfire</username>
<password>${DB_PASSWORD}</password>
<testSQL>select 1</testSQL>
<testBeforeUse>false</testBeforeUse>
<testAfterUse>false</testAfterUse>
<minConnections>5</minConnections>
<maxConnections>25</maxConnections>
<connectionTimeout>1.0</connectionTimeout>
</defaultProvider>
</database>
<autosetup>
<run>true</run>
<locale>en</locale>
<xmpp>
<auth>
<anonymous>true</anonymous>
</auth>
<domain>testopenfire.services</domain>
<fqdn>chat.testopenfire.services</fqdn>
</xmpp>
<admin>
<email>admin@example.com</email>
<password>admin</password>
</admin>
</autosetup>
<provider>
<user>
<className>org.jivesoftware.openfire.ldap.LdapUserProvider</className>
</user>
<group>
<className>org.jivesoftware.openfire.ldap.LdapGroupProvider</className>
<groupBasedAdminProvider>
<groupName>{{ .Values.ldap.adminGroup }}</groupName>
</groupBasedAdminProvider>
</group>
<auth>
<className>org.jivesoftware.openfire.ldap.LdapAuthProvider</className>
</auth>
<admin>
<className>org.jivesoftware.openfire.admin.GroupBasedAdminProvider</className>
</admin>
</provider>
<ldap>
<host>{{ .Values.ldap.host }}</host>
<port>{{ .Values.ldap.port }}</port>
<usernameField>cn</usernameField>
<baseDN>{{ .Values.ldap.baseDN }}</baseDN>
<nameField>cn</nameField>
<searchFilter>(&(objectClass=inetOrgPerson)(cn={0}))</searchFilter>
<groupNameField>cn</groupNameField>
<adminPassword>${LDAP_PASSWORD}</adminPassword>
<groupMemberField>member</groupMemberField>
<groupDescriptionField>description</groupDescriptionField>
<posixMode>false</posixMode>
<groupSearchFilter>(objectClass=groupOfNames)</groupSearchFilter>
<adminDN>{{ .Values.ldap.adminDN }}</adminDN>
<connectionProtocol>{{ .Values.ldap.connectionProtocol }}</connectionProtocol>
<connectionPoolEnabled>{{ .Values.ldap.connectionPoolEnabled }}</connectionPoolEnabled>
<sslEnabled>{{ .Values.ldap.sslEnabled }}</sslEnabled>
<startTlsEnabled>{{ .Values.ldap.startTlsEnabled }}</startTlsEnabled>
</ldap>
</jive>
and the security.xml
<?xml version="1.0" encoding="UTF-8"?>
<security>
<encrypt>
<algorithm>Blowfish</algorithm>
<key>
<current></current>
</key>
<property>
<name>database.defaultProvider.username</name>
<name>database.defaultProvider.password</name>
<name>ldap.adminPassword</name>
</property>
</encrypt>
</security>
Plain text ldap admin password is: 0GnNNNMJ6pQTxsIW
The following Postgres log shows that Openfire encrypts the ldap.adminPassword, but for some reason it updates it again with the plain text password after encryption, so it ends up remaining in the database in plain text format.
2026-02-16 19:20:51.736 UTC [110] DETAIL: parameters: $1 = 'ldap.adminPassword', $2 = '0GnNNNMJ6pQTxsIW', $3 = '0', $4 = NULL
2026-02-16 19:20:51.736 UTC [110] LOG: execute S_1: INSERT INTO ofProperty(name, propValue, encrypted, iv) VALUES($1,$2,$3,$4)
2026-02-16 19:20:51.736 UTC [110] DETAIL: parameters: $1 = 'ldap.adminPassword', $2 = '0GnNNNMJ6pQTxsIW', $3 = '0', $4 = NULL
2026-02-16 19:20:51.736 UTC [110] LOG: duration: 0.092 ms
2026-02-16 19:20:51.742 UTC [110] LOG: duration: 3.043 ms parse <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.742 UTC [110] LOG: duration: 0.114 ms bind <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.742 UTC [110] DETAIL: parameters: $1 = 'f9639af92b2f895acc4e4ec8dad33cf455b10d3ee9eaeeddfd0cca8acf862c4159f1c73933530d716d6e409a5ad8184b', $2 = '1', $3 = 'gno1Vz5i3TGB3UrUxcAdkA==', $4 = 'ldap.adminPassword'
2026-02-16 19:20:51.742 UTC [110] LOG: execute <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.742 UTC [110] DETAIL: parameters: $1 = 'f9639af92b2f895acc4e4ec8dad33cf455b10d3ee9eaeeddfd0cca8acf862c4159f1c73933530d716d6e409a5ad8184b', $2 = '1', $3 = 'gno1Vz5i3TGB3UrUxcAdkA==', $4 = 'ldap.adminPassword'
2026-02-16 19:20:51.745 UTC [110] LOG: duration: 2.195 ms
2026-02-16 19:20:51.764 UTC [110] LOG: duration: 0.100 ms parse <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.764 UTC [110] LOG: duration: 0.105 ms bind <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.764 UTC [110] DETAIL: parameters: $1 = '0GnNNNMJ6pQTxsIW', $2 = '0', $3 = NULL, $4 = 'ldap.adminPassword'
2026-02-16 19:20:51.764 UTC [110] LOG: execute <unnamed>: UPDATE ofProperty SET propValue=$1, encrypted=$2, iv=$3 WHERE name=$4
2026-02-16 19:20:51.764 UTC [110] DETAIL: parameters: $1 = '0GnNNNMJ6pQTxsIW', $2 = '0', $3 = NULL, $4 = 'ldap.adminPassword'
2026-02-16 19:20:51.764 UTC [110] LOG: duration: 0.082 ms
My code does not contain any sql commands, Openfire is only configured via xml files.
Based on what I wrote, do you have any ideas on where I should go next?
Thank you in advance for your help.
Miklos
