DB password encryption

[ttran]

How do I encrypt the clear text password from the server.properties file?


sql.Oracle.driver.url: jdbc:oracle:thin:@***
sql.Oracle.driver.password: *****

[Isomorphic]

This is not generally a security concern, since if an attacker can read this file he has already compromised your system. However, if you're concerned about this anyway, use JNDI-based configuration instead, or use the server-side Config class to inject the credentials dynamically after loading them some other way.

[ttran]

I understand what you are saying about the issue mute once someone already gotten to the config file. But our security group will not bless my app unless the password is hashed up somehow. Can you show me how to do the later approach?

I think something like what Hibernate did with Jasypt. I got that to work. I just need to find out where I can inject the connection password.

Thannks,

[Isomorphic]

Two solutions have already been provided in post #2 above.

[ttran]

yes, I need to find out what your server side config class is where I can do the injection?