Skip to main content Skip to complementary content
Qlik Resources
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal
Loading SearchUnify's search If you need assistance with your product, please contact Qlik Support.
Qlik Customer Portal

Managing users and passwords

Last updated: 9/10/2026

Manage runtime users and passwords, including security hardening and password encryption behavior introduced in patch 8.0.1.

The default security configuration uses a property file located at <RuntimeContainerPath>/etc/users.properties to store authorized users and their passwords. The default user name is tadmin and the associated password is tadmin. We strongly encourage you to change the default password before moving Karaf into production.

Information noteWarning: Avoid the $ character in passwords on Linux systems because the operating system can interpret $ as a variable, which makes the password incorrect during patching.

These users control access to three areas in Karaf:

  • access to the SSH console

  • access to the JMX management layer

  • access to the Web console

These three access paths all delegate to the same JAAS-based security authentication.

Security hardening and password encryption

Changing default passwords before production use

Three system users are delivered with default credentials in etc/users.properties: tadmin, tesb, and karaf.

Since patch 8.0.1.R2026-02-RT, if any system user keeps a default password, SSH access to Talend ESB Runtime is automatically restricted to 127.0.0.1. This behavior is controlled by sshHost in etc/org.apache.karaf.shell.cfg.

Change the default passwords in etc/users.properties before starting the runtime, or before applying the patch.

Password encryption enforced since patch 8.0.1.R2026-05-RT

From patch 8.0.1.R2026-05-RT, system user passwords in etc/users.properties are automatically encrypted on the first startup after the patch is applied. The following updates are applied automatically:

  1. Password encryption is activated in etc/org.apache.karaf.jaas.cfg with encryption.enabled = true and encryption.name = jasypt.

  2. Passwords in etc/users.properties are encrypted in place.

  3. The file etc/org.talend.esb.vault.add is created and then replaced by etc/org.talend.esb.vault.dat at the next startup.

  4. New environment variable definitions with a _NEW suffix are added to bin/setsecenv, bin\setsecenv.bat, or <service name>-wrapper.conf if the runtime is installed as a service.

If default passwords are still present after patching, update them immediately:

  1. Edit etc/users.properties and replace each default password with a new plaintext password. The runtime encrypts the new value at next startup.

  2. Edit etc/org.talend.esb.vault.add and replace the default passwords with the new passwords.

Removing cleartext passwords from startup scripts

After patch 8.0.1.R2026-05-RT, remove cleartext passwords from bin/setsecenv (Linux or macOS), bin\setsecenv.bat (Windows), or <service name>-wrapper.conf for service installations.

  1. Find the variables created by the patch with the _NEW suffix.

  2. Remove the _NEW suffix from each variable name.

  3. Delete the previous variable definitions that still include cleartext passwords.

  4. Restart the runtime or the wrapper service. After startup, etc/users.properties contains encrypted passwords and etc/org.talend.esb.vault.dat replaces etc/org.talend.esb.vault.add.

Final state of bin/setsecenv:

export TESB_AMQ_GUI_USER_PASSWORD=VAULT\(tesb\)
export TESB_AUXSTORE_AUTHENTICATION_PASSWORD=VAULT\(karaf\)
export TESB_AUXSTORE_SAML_PASSWORD=VAULT\(tadmin\)
export TESB_LOCATOR_AUTHENTICATION_PASSWORD=VAULT\(tesb\)
export TESB_REGISTRY_AUTHENTICATION_PASSWORD=VAULT\(karaf\)
export TESB_REGISTRY_SAML_PASSWORD=VAULT\(tadmin\)
export TESB_SAML_SECURITY_PASSWORD=VAULT\(tadmin\)
export TESB_SAM_SERVICE_SECURITY_PASSWORD=VAULT\(tesb\)

Final state of bin\setsecenv.bat:

set TESB_AMQ_GUI_USER_PASSWORD=VAULT(tesb)
set TESB_AUXSTORE_AUTHENTICATION_PASSWORD=VAULT(karaf)
set TESB_AUXSTORE_SAML_PASSWORD=VAULT(tadmin)
set TESB_LOCATOR_AUTHENTICATION_PASSWORD=VAULT(tesb)
set TESB_REGISTRY_AUTHENTICATION_PASSWORD=VAULT(karaf)
set TESB_REGISTRY_SAML_PASSWORD=VAULT(tadmin)
set TESB_SAML_SECURITY_PASSWORD=VAULT(tadmin)
set TESB_SAM_SERVICE_SECURITY_PASSWORD=VAULT(tesb)

Changing system user passwords after encryption is active

When etc/org.talend.esb.vault.dat exists, use the following procedure to change a system user password:

  1. Edit etc/users.properties and replace the encrypted password with the new plaintext password.

  2. Create or update etc/org.talend.esb.vault.add with the new passwords.

    user1=password1
user2=password2
user3=password3

  3. Restart the runtime or the wrapper service to apply the update. The etc/org.talend.esb.vault.add file is consumed and replaced by etc/org.talend.esb.vault.dat.

Information noteNote: If the runtime starts as a wrapper service, apply the startup variable updates in <service name>-wrapper.conf because setsecenv or setsecenv.bat is not used at startup.

The users.properties file contains one or more lines. Each line defines a user, its password, and the associated roles:

user=password[,role][,role]...

Did this page help you?

If you find any issues with this page or its content – a typo, a missing step, or a technical error – please let us know!

Leave your feedback here