# Database hardening

**URL:** <https://forum.keycloak.org/t/database-hardening/1742>\
**Category:** Getting advice\
**Created:** [March 18, 2020, 7:06pm UTC](https://forum.keycloak.org/t/database-hardening/1742 "2020-03-18T19:06:51Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![charleschua](https://avatars.discourse-cdn.com/v4/letter/c/b9bd4f/32.png) [@charleschua](https://forum.keycloak.org/u/charleschua)\
**Post date:** [March 18, 2020, 7:06pm UTC](https://forum.keycloak.org/t/database-hardening/1742/1 "2020-03-18T19:06:51Z")

</div>

Hi,  
For my usecase, I have a relational database as a backend for Keycloak. Some secrets such as Oauth2 client secrets are stored in the database a clear text. Do you have any recommendation to harden the DB to improve security?

On the other hand, what would be the best practise from security perspective for deployment?

Thanks,  
Chales

---

<div class="post-metadata">

**Author:** ![mposolda](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/mposolda/32/12_2.png) [@mposolda](https://forum.keycloak.org/u/mposolda)\
**Post date:** [March 19, 2020, 7:49am UTC](https://forum.keycloak.org/t/database-hardening/1742/2 "2020-03-19T07:49:38Z")

</div>

We have Vault support in later versions of Keycloak. However I see that  
it doesn’t (yet) support validation/storage of client secrets per  
[https://www.keycloak.org/docs/latest/server\_admin/#\_vault-administration](https://www.keycloak.org/docs/latest/server_admin/#_vault-administration) .

So if the client secret is a concern, the more secure alternative is to  
authenticate clients with the private key JWT. For the details, see  
[https://www.keycloak.org/docs/latest/server\_admin/#\_client-credentials](https://www.keycloak.org/docs/latest/server_admin/#_client-credentials)  
and  
[https://www.keycloak.org/docs/latest/securing\_apps/#\_client\_authentication\_adapter](https://www.keycloak.org/docs/latest/securing_apps/#_client_authentication_adapter)  
and OpenID Connect specification chapter about client authentication.

Marek

---

<div class="post-metadata">

**Author:** ![charleschua](https://avatars.discourse-cdn.com/v4/letter/c/b9bd4f/32.png) [@charleschua](https://forum.keycloak.org/u/charleschua)\
**Post date:** [March 19, 2020, 6:25pm UTC](https://forum.keycloak.org/t/database-hardening/1742/3 "2020-03-19T18:25:16Z")

</div>

Thanks Marek.  
A side tracked question: in Keycloak, would it be feasible to build an extension so that the secrets from client will be encrypted before it is processed downstream and it will be decrypted after it is read from DB? If it is feasible, can you please kindly point me to some documents?  
Thanks again!  
Chales

---

<div class="post-metadata">

**Author:** ![fidgi](https://yyz2.discourse-cdn.com/free1/user_avatar/forum.keycloak.org/fidgi/32/92_2.png) [@fidgi](https://forum.keycloak.org/u/fidgi)\
**Post date:** [October 5, 2020, 5:20pm UTC](https://forum.keycloak.org/t/database-hardening/1742/4 "2020-10-05T17:20:57Z")

</div>

Any good news about the ability to manage client secrets using a Vault ? Either from the development team or the community ?

Does any has already investigated this point and should be able to share some clues about how to implement a Vault provider to manage client secrets ?

Regards,