Matt Luce

Security requirements at my place of employment don’t allow for plain text passwords in any type of configuration files. So we are forced to store passwords encrypted and then decrypt them in every application that needs to create a database connection. This wasn’t an issue for applications that run in a container as Weblogic encrypts the password, but it really limited our use of Spring in non-container apps. To get around this, I’ve created a new subclass of the Spring implementation of javax.sql.Datasource (org.springframework.jdbc.datasource.DriverManagerDataSource) : SecureDriverManagerDataSource which overrides the getPassword() and getConnectionFromDriverManager() methods and adds a new attribute: key. In my implementation of this class, an encrypted password is expected, so before calling the getConnection() method, the password is decrypted using the key attribute. Here is the source code:

public class SecureDriverManagerDataSource extends DriverManagerDataSource
{
    private String key;

    public String getKey()
    {
        return key;
    }

    public void setKey(String key)
    {
        this.key = key;
    }

    public String getPassword()
    {
        if (getKey() == null)
        {
            throw new RuntimeException("Key Value is not set");
        }
        try
        {   // possible future enhancement, allow user to set which type of encryption to use for this class
            return SimpleAESEncrypter.decrypt(super.getPassword(),getKey());
        }
        catch (SimpleAESEncrypterException e)
        {
            throw new RuntimeException(e.getMessage(),e);
        }
    }

    protected Connection getConnectionFromDriverManager() throws SQLException
    {
        return getConnectionFromDriverManager(getUrl(),getUsername(), getPassword());
    }
}

And the Spring Bean Defininition:

<bean id="secureDataSource" class="com.mattluce.db.SecureDriverManagerDataSource" lazy-init="true">
        <property name="driverClassName">
            <value>com.sybase.jdbc2.jdbc.SybDriver</value>
        </property>
        <property name="url">
            <value>jdbc:sybase:Tds:dbserver:1234</value>
        </property>
        <property name="username">
            <value>dbuser</value>
        </property>
        <property name="password">
            <value>x345sdfxxxdasdf==</value>
        </property>
         <property name="key">
            <value>rxxrt56xxc5uuEO/A==</value>
        </property>
    </bean> This implemenation uses our AES encryption utility, but it could be modified to set the encryption implentation as another attribute of the Datasource. You could then set that in the Spring Bean Definition as well

This entry was posted on Friday, August 12th, 2005 at 3:22 pm and is filed under java. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.