# \#security **URL:** https://forum.payara.fish/tag/security/2.md [Latest](https://forum.payara.fish/latest.md) · [Categories](https://forum.payara.fish/categories.md) · [Tags](https://forum.payara.fish/tags.md) --- ## [Security with OpenId and Eclipse Microprofile JWT](https://forum.payara.fish/t/security-with-openid-and-eclipse-microprofile-jwt/1787)
**Author:** [@Zeta](https://forum.payara.fish/u/Zeta)\ **Replies:** 0\ **Last updated:** [March 17, 2026, 7:49am UTC](https://forum.payara.fish/t/security-with-openid-and-eclipse-microprofile-jwt/1787 "2026-03-17T07:49:33Z")
Can a single Web application that contains both REST services and Web pages be secured by a different security mechanism? OpenId authentication is currently designed to implement the OpenId Authorization Code Flow which… --- ## [Container initiated authentication](https://forum.payara.fish/t/container-initiated-authentication/1777)
**Author:** [@ThomasP](https://forum.payara.fish/u/ThomasP)\ **Replies:** 0\ **Last updated:** [January 24, 2026, 2:11pm UTC](https://forum.payara.fish/t/container-initiated-authentication/1777 "2026-01-24T14:11:03Z")
I’m trieing to implement a very basic example of container initiated authentication. I defined the roles and constraints in web.xml: \ \VIEW\_USER\_PAGES\ \ **Author:** [@CTownleySEEMiS](https://forum.payara.fish/u/CTownleySEEMiS)\ **Replies:** 3\ **Last updated:** [July 25, 2025, 10:34am UTC](https://forum.payara.fish/t/client-certificate-usage-question/648 "2025-07-25T10:34:34Z") During testing of a newer version of Payara 5, we noticed a log message as follows. (NB: I have edited to hide some specific details but can provide the full logs if required). After some investigation, this appears to b… --- ## [Payara 6 on RH JDK in FIPS mode](https://forum.payara.fish/t/payara-6-on-rh-jdk-in-fips-mode/1658)
**Author:** [@bernie](https://forum.payara.fish/u/bernie)\ **Replies:** 4\ **Last updated:** [April 14, 2025, 10:40am UTC](https://forum.payara.fish/t/payara-6-on-rh-jdk-in-fips-mode/1658 "2025-04-14T10:40:59Z")
Is it possible to run payara 6.2025.1 server on RHEL 9’s openJDK 21 in FIPS mode? When attempted, asadmin create-domain fails with CLI130: Could not create domain, spdf Command create-domain failed. ERROR: create-domai… --- ## [Facing difficulty while enabling SSL connection for DB in payara 6.2023.9](https://forum.payara.fish/t/facing-difficulty-while-enabling-ssl-connection-for-db-in-payara-6-2023-9/778)
**Author:** [@smak](https://forum.payara.fish/u/smak)\ **Replies:** 1\ **Last updated:** [September 19, 2024, 8:03pm UTC](https://forum.payara.fish/t/facing-difficulty-while-enabling-ssl-connection-for-db-in-payara-6-2023-9/778 "2024-09-19T20:03:00Z")
Hi all, I am using payara 6.2023.9 server for my web application. As discussed in Bug report: Unable to connect securely to database for connection pooling · Issue #5424 · payara/Payara · GitHub - I have SSL enabled RD… --- ## [Cannot configure cert-nickname in 5.2022.5](https://forum.payara.fish/t/cannot-configure-cert-nickname-in-5-2022-5/898)
**Author:** [@krahe](https://forum.payara.fish/u/krahe)\ **Replies:** 1\ **Last updated:** [August 29, 2024, 9:02pm UTC](https://forum.payara.fish/t/cannot-configure-cert-nickname-in-5-2022-5/898 "2024-08-29T21:02:17Z")
I have installed 5.2022.5 Community Edition under Ubuntu Linux v22.04. The default installation was working fine, but I wanted to upgrade the security certificate to one generated specifically for my domain rather than u… --- ## [Log4j security issue](https://forum.payara.fish/t/log4j-security-issue/169)
**Author:** [@Marketing](https://forum.payara.fish/u/Marketing)\ **Replies:** 6\ **Last updated:** [July 18, 2022, 8:11am UTC](https://forum.payara.fish/t/log4j-security-issue/169 "2022-07-18T08:11:09Z")
Payara products don’t use the Log4j library directly, but if your application is using it, we recommend that you upgrade to the latest version of Log4J especially when running on a vulnerable JDK version. See Log4Shell: … --- ## [Requires a master-password at startup](https://forum.payara.fish/t/requires-a-master-password-at-startup/864)
**Author:** [@san3k](https://forum.payara.fish/u/san3k)\ **Replies:** 0\ **Last updated:** [June 21, 2024, 6:19am UTC](https://forum.payara.fish/t/requires-a-master-password-at-startup/864 "2024-06-21T06:19:10Z")
You need to put a Java version greater than 17 in the appclient.bat file. Then everything works. --- ## [Jdbc Realm show a rare behaviour](https://forum.payara.fish/t/jdbc-realm-show-a-rare-behaviour/826)
**Author:** [@Fernando77](https://forum.payara.fish/u/Fernando77)\ **Replies:** 1\ **Last updated:** [May 21, 2024, 7:26pm UTC](https://forum.payara.fish/t/jdbc-realm-show-a-rare-behaviour/826 "2024-05-21T19:26:41Z")
Hi all!, I am experiencing strange behavior and I think that is because there are some misconfiguration in payara realms configuration, but I can’t found my error. My small application works ok in development mode, but… --- ## [How to pass JSESSIONID in headers rather than as a url parameter?](https://forum.payara.fish/t/how-to-pass-jsessionid-in-headers-rather-than-as-a-url-parameter/817)
**Author:** [@theirman](https://forum.payara.fish/u/theirman)\ **Replies:** 0\ **Last updated:** [April 18, 2024, 7:22am UTC](https://forum.payara.fish/t/how-to-pass-jsessionid-in-headers-rather-than-as-a-url-parameter/817 "2024-04-18T07:22:25Z")
Hello I want to connect a java web application (WAR hosted on Payara Server) to a CAS server in my company. The IT department has configured it so that it can be authorized on the SSO side. But we get an error after au… --- ## [Security Settings - HSTS, Content Security Policy, X-Content-Type-Options](https://forum.payara.fish/t/security-settings-hsts-content-security-policy-x-content-type-options/787)
**Author:** [@sangamaes](https://forum.payara.fish/u/sangamaes)\ **Replies:** 1\ **Last updated:** [March 3, 2024, 9:03am UTC](https://forum.payara.fish/t/security-settings-hsts-content-security-policy-x-content-type-options/787 "2024-03-03T09:03:08Z")
Hi, I’m using Payara Community Edition \[version 2.2022.2\] (https://repo1.maven.org/maven2/fish/payara/distributions/payara/5.2022.2/payara-5.2022.2.zip) for one of the application and using Micro version for another 2 ch… --- ## [User redirect after login](https://forum.payara.fish/t/user-redirect-after-login/779)
**Author:** [@brasta78](https://forum.payara.fish/u/brasta78)\ **Replies:** 1\ **Last updated:** [February 23, 2024, 5:51pm UTC](https://forum.payara.fish/t/user-redirect-after-login/779 "2024-02-23T17:51:35Z")
hi, I use CustomFormAuthenticationMechanismDefinition for my web app and I want to redirect to a different welcome page based on logged in user group. What is a recommended approach to do that? --- ## [Question on OpenIdAuthenticationMechanism](https://forum.payara.fish/t/question-on-openidauthenticationmechanism/782)
**Author:** [@juditkapinya](https://forum.payara.fish/u/juditkapinya)\ **Replies:** 0\ **Last updated:** [February 23, 2024, 3:37pm UTC](https://forum.payara.fish/t/question-on-openidauthenticationmechanism/782 "2024-02-23T15:37:28Z")
Do I understand correctly that OpenIdAuthenticationMechanism implements only 3.1 Authentication using the Authorization Code Flow from here “Final: OpenID Connect Core 1.0 incorporating errata set 2”? If the provider re… --- ## [Payara temporary redirect responses](https://forum.payara.fish/t/payara-temporary-redirect-responses/731)
**Author:** [@AYADI](https://forum.payara.fish/u/AYADI)\ **Replies:** 0\ **Last updated:** [December 6, 2023, 8:02am UTC](https://forum.payara.fish/t/payara-temporary-redirect-responses/731 "2023-12-06T08:02:29Z")
Displaying payara server IP address in 302 temporary redirect responses is a security vulnerability, how can we solve the problem? --- ## [How to renewal SSL Certificate?](https://forum.payara.fish/t/how-to-renewal-ssl-certificate/704)
**Author:** [@velmurugan](https://forum.payara.fish/u/velmurugan)\ **Replies:** 0\ **Last updated:** [October 12, 2023, 11:59am UTC](https://forum.payara.fish/t/how-to-renewal-ssl-certificate/704 "2023-10-12T11:59:06Z")
Hello, Please anyone send me the document for SSL certificate renewal payara application. --- ## [Modify Admin Console( need to add autocomplete="off")](https://forum.payara.fish/t/modify-admin-console-need-to-add-autocomplete-off/681)
**Author:** [@GabyFok](https://forum.payara.fish/u/GabyFok)\ **Replies:** 0\ **Last updated:** [August 23, 2023, 9:45am UTC](https://forum.payara.fish/t/modify-admin-console-need-to-add-autocomplete-off/681 "2023-08-23T09:45:56Z")
Hi all, I would like to modify Admin Console login page. I need to add autocomplete=“off” to the password tag or directly to the whole input form. I have tried to modify all the login.xhtml, but still failed. Please … --- ## [Authenticating using OpenId Connect and Keycloak](https://forum.payara.fish/t/authenticating-using-openid-connect-and-keycloak/601)
**Author:** [@Cistox](https://forum.payara.fish/u/Cistox)\ **Replies:** 3\ **Last updated:** [June 12, 2023, 8:06pm UTC](https://forum.payara.fish/t/authenticating-using-openid-connect-and-keycloak/601 "2023-06-12T20:06:48Z")
Hello, I implemented the Payara OpenId Connector in order to authenticate with the Keycloak OIDC provider. I am using Payara Community 5.2022.5 I reach the Keycloak authentication form after visiting a protected page … --- ## [OKTA external authentication](https://forum.payara.fish/t/okta-external-authentication/592)
**Author:** [@rahul.kolan](https://forum.payara.fish/u/rahul.kolan)\ **Replies:** 0\ **Last updated:** [April 14, 2023, 11:19am UTC](https://forum.payara.fish/t/okta-external-authentication/592 "2023-04-14T11:19:23Z")
Hello Team, I want to configure OKTA two factor authentication for my web application that deployed on the Payara server. we already have OKTA in our company. is there anyone configured this use case? if yes, pls send m… --- ## [Connecting Kafka to Payara](https://forum.payara.fish/t/connecting-kafka-to-payara/544)
**Author:** [@JanNilsson](https://forum.payara.fish/u/JanNilsson)\ **Replies:** 0\ **Last updated:** [January 17, 2023, 9:33am UTC](https://forum.payara.fish/t/connecting-kafka-to-payara/544 "2023-01-17T09:33:33Z")
Hi Has anybody connected Kafka and ACL to a Payara server that uses declared security annotations like @DeclaredRoles @RolesAllowed? I’m interested in the translation/connection from the ACL’s roles to the roles defin… --- ## [Payara5-2022.3 not working under Windows 10 / FISH-6553](https://forum.payara.fish/t/payara5-2022-3-not-working-under-windows-10-fish-6553/453)
**Author:** [@jim-zhang](https://forum.payara.fish/u/jim-zhang)\ **Replies:** 5\ **Last updated:** [September 20, 2022, 4:02pm UTC](https://forum.payara.fish/t/payara5-2022-3-not-working-under-windows-10-fish-6553/453 "2022-09-20T16:02:30Z")
Windows defender failed to scan payara5-2022.3 since Sept 16. --- ## [What encryption does the JKS associated with the Password Alias feature use](https://forum.payara.fish/t/what-encryption-does-the-jks-associated-with-the-password-alias-feature-use/437)
**Author:** [@nmodin](https://forum.payara.fish/u/nmodin)\ **Replies:** 1\ **Last updated:** [August 30, 2022, 3:32pm UTC](https://forum.payara.fish/t/what-encryption-does-the-jks-associated-with-the-password-alias-feature-use/437 "2022-08-30T15:32:05Z")
Hi, I have been trying to find what encryption algorithm is being used for the Password Alias feature, but haven’t found a clear answer. Anyone out there who knows? :slight\_smile: Cheers, Niklas --- ## [IUCLID6 on Ubuntu: Payara Server: need Secure Admin enabled to access the DAS remotely](https://forum.payara.fish/t/iuclid6-on-ubuntu-payara-server-need-secure-admin-enabled-to-access-the-das-remotely/333)
**Author:** [@fpacchia](https://forum.payara.fish/u/fpacchia)\ **Replies:** 1\ **Last updated:** [June 29, 2022, 10:26am UTC](https://forum.payara.fish/t/iuclid6-on-ubuntu-payara-server-need-secure-admin-enabled-to-access-the-das-remotely/333 "2022-06-29T10:26:09Z")
While enabling secure-admin on Payara paltform I receive this error: $ ./asadmin enable-secure-admin Enter admin user name\> admin Enter admin password for user “admin”\> remote failure: NCLS-SECURITY-05200 : org.jvn… --- ## [Random Ports Payara](https://forum.payara.fish/t/random-ports-payara/342)
**Author:** [@YonierRestrepo](https://forum.payara.fish/u/YonierRestrepo)\ **Replies:** 0\ **Last updated:** [June 3, 2022, 3:23am UTC](https://forum.payara.fish/t/random-ports-payara/342 "2022-06-03T03:23:05Z")
Your help please. I am trying to close the ports that I do not use in the Payara5 version instance, I have closed several but there are 2 services that start with random ports, that is, when the Server is turned on they… --- ## [Azure AD JWT Token doesn't contain jti claim and fails validation](https://forum.payara.fish/t/azure-ad-jwt-token-doesnt-contain-jti-claim-and-fails-validation/340)
**Author:** [@gbuxton77](https://forum.payara.fish/u/gbuxton77)\ **Replies:** 0\ **Last updated:** [June 1, 2022, 8:42pm UTC](https://forum.payara.fish/t/azure-ad-jwt-token-doesnt-contain-jti-claim-and-fails-validation/340 "2022-06-01T20:42:03Z")
fish.payara.microprofile.jwtauth.jwt.JwtTokenParser apparently requires the jti claim but it’s not present on AzureAD-issued JWT Tokens. Is there any work-around to allow configuration of which claim types are required? … --- ## [jwtauth.eesecurity.JWTProcessingException](https://forum.payara.fish/t/jwtauth-eesecurity-jwtprocessingexception/319)
**Author:** [@UlrichC](https://forum.payara.fish/u/UlrichC)\ **Replies:** 0\ **Last updated:** [May 8, 2022, 2:39pm UTC](https://forum.payara.fish/t/jwtauth-eesecurity-jwtprocessingexception/319 "2022-05-08T14:39:53Z")
Hi to all, after this issue (Bug Report: java.lang.LinkageError while classloading “com.nimbusds.jwt.JWTClaimsSet” FISH-5941 (Issue #5533) was finally solved in the 5.2022.2 version, I was happy to update from 2021.5. … --- ## [WebService Soap call with client authentication using LoginModule](https://forum.payara.fish/t/webservice-soap-call-with-client-authentication-using-loginmodule/257)
**Author:** [@systempro](https://forum.payara.fish/u/systempro)\ **Replies:** 0\ **Last updated:** [March 21, 2022, 1:00pm UTC](https://forum.payara.fish/t/webservice-soap-call-with-client-authentication-using-loginmodule/257 "2022-03-21T13:00:30Z")
I have a WebService and I use client authentication validating certificates. I created a .jar, which serves to authenticate my service, added the property “jaas-context” and configured my login.conf. My authentication wo… --- ## [Asadmin\> enable-secure-admin - fails with NCLS-SECURITY-05200 error](https://forum.payara.fish/t/asadmin-enable-secure-admin-fails-with-ncls-security-05200-error/241)
**Author:** [@schadha](https://forum.payara.fish/u/schadha)\ **Replies:** 2\ **Last updated:** [March 14, 2022, 12:42pm UTC](https://forum.payara.fish/t/asadmin-enable-secure-admin-fails-with-ncls-security-05200-error/241 "2022-03-14T12:42:04Z")
On the Payrara Admin server when I login I get this error: Secure Admin must be enabled to access the DAS remotely. To resolve this issue I tried to enable-secure-admin but this fails. So I am stuck. root@ubuntu-s-1vc… --- ## [How to post and follow security issue](https://forum.payara.fish/t/how-to-post-and-follow-security-issue/222)
**Author:** [@robelcik](https://forum.payara.fish/u/robelcik)\ **Replies:** 1\ **Last updated:** [March 9, 2022, 9:19am UTC](https://forum.payara.fish/t/how-to-post-and-follow-security-issue/222 "2022-03-09T09:19:07Z")
Hello, In December, I sent to security@payara.fish a report about a known DoS vulnerability in one of libraries included in Payara. I haven’t got any reply and I can see that mentioned library has not been upgraded in 5… --- ## [How to detect context path on virtual server](https://forum.payara.fish/t/how-to-detect-context-path-on-virtual-server/217)
**Author:** [@mirozitnansky](https://forum.payara.fish/u/mirozitnansky)\ **Replies:** 0\ **Last updated:** [February 11, 2022, 2:38pm UTC](https://forum.payara.fish/t/how-to-detect-context-path-on-virtual-server/217 "2022-02-11T14:38:45Z")
Hello we have deployed on 5.2021.9 app portal to contextroot /portal Also, we have configured virtual server for hostname www.portal.xx which has set Default Web Module to our portal app. Everything works as expected,…