application connect to database

Question

I am working on an application that will be used by schools. Each school will set up their on database. And each school will provide their own \"settings\" file to the appli

Answer 1

Take a look at Jasypt, it is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

In case you use Spring, you can define your db.properties as:

 jdbc.driver=com.mysql.jdbc.Driver
 jdbc.url=jdbc:mysql://localhost/yourdb
 jdbc.username=userName
 jdbc.password=ENC(A6L729KukPEx7Ps8didIUWb01fdBRh7d)

and configure it with Jasypt and Spring as:

<bean class="org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer">
   <constructor-arg>
     <bean class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
       <property name="config">
         <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
           <property name="algorithm" value="PBEWithMD5AndDES" />
           <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
         </bean>
       </property>
     </bean>
   </constructor-arg>
   <property name="locations">
     <list>
       <value>classpath:/META-INF/props/db/db.properties</value>
     </list>
   </property>   
</bean>

<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
    <property name="driverClassName" value="${jdbc.driverClassName}"/>
    <property name="url" value="${jdbc.url}"/>
    <property name="username" value="${jdbc.username}"/>
    <property name="password" value="${jdbc.password}"/>
</bean>

This would hide the actual password (you can do the same for the username) from students, so they would not be able to derive the connection string from looking at the properties file.

In case you are not using Spring, here is a Jasypt guide to achive the same "manually"