# Hide LDAP credentials in config file

**URL:** <https://forum.opensearch.org/t/hide-ldap-credentials-in-config-file/17996>\
**Category:** Security\
**Tags:** configure\
**Created:** [February 21, 2024, 10:36am UTC](https://forum.opensearch.org/t/hide-ldap-credentials-in-config-file/17996 "2024-02-21T10:36:26Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [February 21, 2024, 10:36am UTC](https://forum.opensearch.org/t/hide-ldap-credentials-in-config-file/17996/1 "2024-02-21T10:36:27Z")

</div>

\*\* On behalf of a user of [Slack](https://opensearch.slack.com/archives/C051Y637FKK/p1708179624152309) \*\*

“Is there a way to use the keystore to store the ldap bind\_dn passwords that you have to normally store unencrypted in the config.xml file? Elasticsearch has documentation it can do this but it’s using a different plugin for security.”

---

<div class="post-metadata">

**Author:** ![Mantas](https://avatars.discourse-cdn.com/v4/letter/m/7bcc69/32.png) [@Mantas](https://forum.opensearch.org/u/Mantas)\
**Post date:** [February 21, 2024, 10:38am UTC](https://forum.opensearch.org/t/hide-ldap-credentials-in-config-file/17996/2 "2024-02-21T10:38:34Z")

</div>

Hi geg6439,

You could try using env variables, see here for more details:  
[Using environmental variables in Open Distro security plugin configuration - #2 by clsa](https://forum.opensearch.org/t/using-environmental-variables-in-open-distro-security-plugin-configuration/1193/2)

Best,  
mj

---

<div class="post-metadata">

**Author:** ![greg6439](https://avatars.discourse-cdn.com/v4/letter/g/b38774/32.png) [@greg6439](https://forum.opensearch.org/u/greg6439)\
**Post date:** [February 22, 2024, 2:18am UTC](https://forum.opensearch.org/t/hide-ldap-credentials-in-config-file/17996/3 "2024-02-22T02:18:50Z")

</div>

This worked great  
I am using docker so i set env variable BIND\_PASSWORD  
I then referenced this in config.yml with  
password: ${env.BIND\_PASSWORD}