---
title: Password replay from a file
description: The following figure illustrates the flow of requests when PingGateway uses credentials in a file to log a user in to the sample application:
component: pinggateway
version: 2025.9
page_id: pinggateway:gateway-guide:credentials-file
canonical_url: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/credentials-file.html
llms_txt: https://docs.pingidentity.com/pinggateway/llms.txt
docs_for_agents: https://developer.pingidentity.com/build-with-ai/docs-for-agents.md
superseded_by: https://docs.pingidentity.com/pinggateway/2026/gateway-guide/credentials-file.html
---

# Password replay from a file

The following figure illustrates the flow of requests when PingGateway uses credentials in a file to log a user in to the sample application:

![Login with credentials retrieved from a file.](_images/login-from-file.svg)

* PingGateway intercepts the browser's HTTP GET request, which matches the route condition.

* The PasswordReplayFilter confirms that a login page is required, and

* The FileAttributesFilter uses the email address to look up the user credentials in a file, and stores the credentials in the request context attributes map.

* The PasswordReplayFilter retrieves the credentials from the attributes map, builds the login form, and performs the HTTP POST request to the sample app.

* The sample application validates the credentials, and responds with a profile page.

* The ReverseProxyHandler passes the response to the browser.

Before you start, prepare PingGateway and the sample application as described in the [Getting started with PingGateway](../getting-started/preface.html).

1. On your system, add the following data in a comma-separated value file:

   * Linux

     `/tmp/userfile.txt`

   * Windows

     `C:\Temp\userfile.txt`

   ```csv
   username,password,fullname,email
   george,C0stanza,George Costanza,george@example.com
   kramer,N3wman12,Kramer,kramer@example.com
   bjensen,H1falutin,Babs Jensen,bjensen@example.com
   demo,Ch4ng31t,Demo User,demo@example.com
   kvaughan,B5ibery12,Kirsten Vaughan,kvaughan@example.com
   scarter,S9rain12,Sam Carter,scarter@example.com
   wolkig,Geh3imnis!,Wilhelm Wolkig,wolkig@example.com
   ```

   Source: [userfile.txt](../_attachments/others/userfile.txt)

2. Set up PingGateway:

   1. Set up PingGateway for HTTPS, as described in [Configure PingGateway for TLS (server-side)](../installation-guide/securing-connections.html#server-side-tls).

   2. Add the following route to PingGateway to serve the sample application .css and other static resources:

      * Linux

        `$HOME/.openig/config/routes/00-static-resources.json`

      * Windows

        `%appdata%\OpenIG\config\routes\00-static-resources.json`

      ```json
      {
        "name" : "00-static-resources",
        "baseURI" : "http://app.example.com:8081",
        "condition": "${find(request.uri.path,'^/css') or matchesWithRegex(request.uri.path, '^/.*\\\\.ico$') or matchesWithRegex(request.uri.path, '^/.*\\\\.gif$')}",
        "handler": "ReverseProxyHandler"
      }
      ```

      Source: [00-static-resources.json](../_attachments/config/routes/00-static-resources.json)

   3. Add the following route to PingGateway:

      * Linux

        `$HOME/.openig/config/routes/02-file.json`

      * Windows

        `%appdata%\OpenIG\config\routes\02-file.json`

      ```json
      {
        "name": "02-file",
        "condition": "${find(request.uri.path, '^/profile')}",
        "capture": "all",
        "handler": {
          "type": "Chain",
          "baseURI": "http://app.example.com:8081",
          "config": {
            "filters": [
              {
                "type": "PasswordReplayFilter",
                "config": {
                  "loginPage": "${find(request.uri.path, '^/profile/george') and (request.method == 'GET')}",
                  "credentials": {
                    "type": "FileAttributesFilter",
                    "config": {
                      "file": "/tmp/userfile.txt",
                      "key": "email",
                      "value": "george@example.com"
                    }
                  },
                  "request": {
                    "method": "POST",
                    "uri": "http://app.example.com:8081/login",
                    "form": {
                      "username": [
                        "${contexts.fileAttributes.record.username}"
                      ],
                      "password": [
                        "${contexts.fileAttributes.record.password}"
                      ]
                    }
                  }
                }
              }
            ],
            "handler": "ReverseProxyHandler"
          }
        }
      }
      ```

      Source: [02-file.json](../_attachments/config/routes/02-file.json)

      Notice the following features of the route:

      * The route matches requests to `/profile`.

      * The `PasswordReplayFilter` specifies a `loginPage` page property:

        * When a request is an HTTP GET, and the request URI path is `/profile/george`, the expression resolves to `true`. The request is directed to a login page.

          The `FileAttributesFilter` looks up the key and value in `/tmp/userfile.txt`, and stores them in the context.

          The `request` object retrieves the username and password from the context, and replaces the browser's original HTTP GET request with an HTTP POST login request, containing the credentials to authenticate.

        * For other requests, the expression resolves to `false`. The request passes to the ReverseProxyHandler, which directs it to the profile page of the sample app.

3. Test the setup:

   1. In your browser's privacy or incognito mode, go to <https://ig.example.com:8443/profile/george>.

   2. If you see warnings that the site isn't secure, respond to the warnings to access the site.

      Because the property `loginPage` resolves to `true`, the PasswordReplayFilter processes the request to obtain the login credentials. The sample app returns the profile page for George.

   3. Go to <https://ig.example.com:8443/profile/bob>, or to any other URI starting with `https://ig.example.com:8443/profile`.

      Because the property `loginPage` resolves to `false`, the PasswordReplayFilter passes the request directly to the ReverseProxyHandler. The sample app returns the login page.