DocumentationExperience Cloud KCS

Updating and encrypting AEM Forms database passwords in JBoss (AEM Forms JEE)

Last update: June 27, 2026

AEM Forms on JEE stores database credentials in JBoss datasource configuration files such as lc_oracle.xml or lc_turnkey.xml, so when the database password changes or needs encryption, AEM Forms can’t authenticate to the datasource and connection errors occur. The failure surfaces during Configuration Manager (LCM) execution or at JBoss startup, typically after a database rotation, a credential change, or a conversion from plain-text to encrypted passwords. Regenerating the encrypted password with the method that matches your JBoss/EAP version and updating the datasource configuration file restores connectivity.

Description description

Environment:

  • AEM Forms on JEE
  • Adobe Experience Manager On-Premises Software
  • JBoss EAP 7.x (PicketBox encryption)
  • JBoss EAP 8 (Elytron credential store)

Issue/Symptoms:

  • LCM reports the error Failed to configure datasource with code ALC-LCM-110-030.
  • JBoss or AEM startup fails with a database error such as Access denied for user (using password: YES).

Root cause:

AEM Forms uses JBoss-defined datasources. When the configured (and often encrypted) password doesn’t match the actual database user password, datasource authentication fails. This occurs when the database password is rotated without updating lc_oracle.xml or lc_turnkey.xml, when the encrypted password isn’t regenerated after a change, or when the environment mixes legacy PicketBox encryption with Elytron credential store entries.

How to confirm

  1. Identify which password mechanism your installation uses. Open lc_turnkey.xml or lc_oracle.xml and look at the password field: a password starting with {MASK-...} indicates PicketBox, while a password expression using credential-store references indicates Elytron.
  2. Confirm the encryption type matches your JBoss/EAP version. PicketBox is typical for EAP 7.x installs; the Elytron credential store is optional for EAP 7.4 and mandatory for EAP 8.

Resolution resolution

  1. Back up the current configuration files before modifying anything. Copy jboss/standalone/configuration/lc_turnkey.xml or lc_oracle.xml and confirm the backup timestamps. Don’t proceed without a backup.

  2. Encrypt the new database password using the PicketBox method for EAP 7.x. Run the encryption command below and enter the new database password when prompted; the command prints an encrypted, masked value.

    code language-none 
    java -cp modules/system/layers/base/org/jboss/logging/main/jboss-logging-3.4.1.Final-redhat-00001.jar;modules/system/layers/base/org/picketbox/main/picketbox-5.0.3.Final-redhat-00007.jar;modules/system/layers/base/org/picketbox/main/picketbox-commons-1.0.0.final-redhat-5.jar;modules/system/layers/base/org/picketbox/main/picketbox-infinispan-5.0.3.Final-redhat-00007.jar org.picketbox.datasource.security.SecureIdentityLoginModule

    If the command fails, confirm the Java path and the module paths exist exactly as shown in your environment.

  3. Update the encrypted password in lc_turnkey.xml or lc_oracle.xml. Replace the existing encrypted value inside the <password> tags with the new encrypted value, and confirm there are no XML syntax errors. If the file becomes invalid, restore from backup and retry.

  4. Restart the application server that hosts AEM Forms. Review server.log for successful datasource initialization. If the server still fails, check the log for SQL authentication errors and revalidate the actual database password.

  5. (Optional) Configure the Elytron credential store if you choose Elytron instead of PicketBox. Follow the Experience League Elytron credential store guide, then confirm JBoss boots with the Elytron-enabled entries. If the store fails to load, revert to PicketBox, which is supported on EAP 7.x installs.

Validation

  1. Confirm AEM startup: the login screen loads without Username and password do not match errors.
  2. Confirm datasource connectivity: no SQL authentication exceptions appear in server.log.
recommendation-more-help
experience-cloud-kcs-help-kbarticles