ECJBA-CE Fails to Authenticate with Database in Rootless Podman Setup

[DevDorrejo]

Hello,

I am setting up a rootless Podman environment with ECJBA-CE, but I am having trouble getting the container to use the DATABASE_PASSWORD correctly. The error message indicates an authentication failure:

2025-03-18 23:48:46,147-0400 ERROR [org.ejbca.ui.cli.jdbc.JdbcTool] (main) FATAL: password authentication failed for user "aetuser"

However, I verified that the database is accessible from other containers in the same pod by manually connecting to PostgreSQL with the same credentials.

Setup Details

I create the database password as a Podman secret and inject it into the container using a quadlet.

Container Configuration in Quadlet

DB_SECRET="db_secret_$(openssl rand -hex 8)"
DB_PASSWORD="$(openssl rand -base64 33 | tr -d '\n')"
echo -n "${DB_PASSWORD}" | podman secret create "${DB_SECRET}" -

cat >"${XDG_CONTAINERS_SERVICE}/${CONT_NAME}.container" <<EOF
[Unit]
Description="${CONT_NAME} Systems"

[Service]
Restart=on-failure
TimeoutStartSec=900

[Container]
Pod=${POD_NAME}.pod
ContainerName=${CONT_NAME}
Image=docker.io/keyfactor/ejbca-ce:latest
Pull=newer
AutoUpdate=registry

Timezone=America/Santo_Domingo

Secret=${DB_SECRET},type=env,target=DATABASE_PASSWORD

Environment="TLS_SETUP_ENABLED=true"
Environment="DATABASE_JDBC_URL=jdbc:postgresql://${DB_CONT}/${DB_NAME}"
Environment="DATABASE_USER=${DB_USER}"
Environment="DATABASE_PASSWORD=\$DATABASE_PASSWORD"
Environment="LOG_LEVEL_APP=INFO"
Environment="LOG_LEVEL_SERVER=INFO"

[Install]
WantedBy=${POD_NAME}.service
EOF

systemctl --user daemon-reload
systemctl --user start ${CONT_NAME}.service
timeout 5s podman logs -f "${CONT_NAME}"

Observations

• The password works when I use another container in the pod to connect manually via psql.
• The error log suggests that ECJBA-CE is not correctly reading the password or that it contains characters that are not properly handled by JDBC.
• The password is injected as a Podman secret (mapped to an environment variable).

Questions

1. Does ECJBA-CE support using Podman secrets for environment variables?
2. Are there any known issues with certain characters in JDBC passwords?
3. Is there a way to debug how ECJBA-CE reads the environment variable for DATABASE_PASSWORD?
4. Is there a way to use DATABASE_PASSWORD_FILE?
5. Which secure way can I pass the password to ECJBA-CE?

Thanks for the help.

[primetomas]

Did you check for example how it's done in the community helm charts?
https://github.com/Keyfactor/ejbca-community-helm

[primetomas]

If I remeber correctly PostgreSQL have different access configuration depending on which client and authentication method you use. See some (in many ways outdated) information here. https://github.com/Keyfactor/ejbca-ce/blob/main/doc/howto/HOWTO-database.txt

[DevDorrejo]

Hello, following the https://github.com/Keyfactor/ejbca-community-helm and postgreSQL pg/sql variables:

podman exec -it -u postgres "${DB_CONT}" bash -c "psql -aE -v db_secret=\"\$(cat /run/secrets/${DB_SECRET})\" <<'EOF'
CREATE USER ${DB_USER} WITH PASSWORD :'db_secret';
CREATE DATABASE ${DB_NAME} OWNER ${DB_USER};
GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};
EOF"

[dobicinaitis]

Could you try accessing the EJBCA container's shell and verify that the password is indeed correctly propagated to the container?

podman exec -it <ejbca-container-name> /bin/bash

echo $DATABASE_PASSWORD

[DevDorrejo]

Could you try accessing the EJBCA container's shell and verify that the password is indeed correctly propagated to the container?

podman exec -it <ejbca-container-name> /bin/bash

echo $DATABASE_PASSWORD

Yes, it has the Env.

[DevDorrejo]

This is solved, thanks for the hands.