Wildfly: Encrypt password and username for database

旧时模样 提交于 2019-12-04 20:41:17

You can use security domain to get over this, there could be some specific changes for Wildfly but for JBoss 7.1.1 here is what you need to do.

  1. Find the location of jboss-logging-3.1.0.GA.jar in your JBoss/Widlfy server. In case of JBoss 7.1.1 it should be something like - modules\org\jboss\logging\main\jboss-logging-3.1.0.GA.jar

  2. Find the location of picketbox-4.0.7.Final.jar

  3. Check if the picketbox jar has org.picketbox.datasource.security.SecureIdentityLoginModule class.

  4. Run the following command from JBoss server root folder to encrypt your datasource connection password

    java -cp modules\org\jboss\logging\main\jboss-logging-3.1.0.GA.jar;modules\org\picketbox\main\picketbox-4.0.7.Final.jar org.picketbox.datasource.security.SecureIdentityLoginModule PasswordXYZ

  5. Get the output text and in the standalone.xml add following security domain under elements:

                <security-domain name="encrypted-ds-WASM2" cache-type="default">
                    <authentication>
                        <login-module code="org.picketbox.datasource.security.SecureIdentityLoginModule" flag="required">
                            <module-option name="username" value="WASM2"/>
                            <module-option name="password" value="89471a19022f8af"/>
                            <module-option name="managedConnectionFactoryName" value="jboss.jca:service=LocalTxCM,name=MySqlDS_Pool"/>
                        </login-module>
                    </authentication>
                </security-domain>
    
  6. Use this security domain in the datasource element as follows:

                <datasource jta="false" jndi-name="java:jboss/jdbc/JNDIDS" pool-name="OFS1" enabled="true" use-ccm="false">
                    <connection-url>jdbc:oracle:thin:@x.x.x.x:1521:xxxx</connection-url>
                    <driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
                    <driver>oracle</driver>
                    <security>
                        <security-domain>encrypted-ds-WASM2</security-domain>
                    </security>
                    <validation>
                        <validate-on-match>false</validate-on-match>
                        <background-validation>false</background-validation>
                        <background-validation-millis>1</background-validation-millis>
                    </validation>
                    <statement>
                        <prepared-statement-cache-size>0</prepared-statement-cache-size>
                        <share-prepared-statements>false</share-prepared-statements>
                    </statement>
                </datasource>
    

Reference Link: http://middlewaremagic.com/jboss/?p=1026

It is not possible. If the web application has to be able to decrypt the password to use the database, anyone on the server can do the same.

If you want to restrict access, keep the server under your control and let them access it only through a web front end.

(And even if it was possible to usefully encrypt, if they have server access they can trivially copy the database files onto their workstations, or add new user accounts to the database server).

易学教程内所有资源均来自网络或用户发布的内容,如有违反法律规定的内容欢迎反馈
该文章没有解决你所遇到的问题?点击提问,说说你的问题,让更多的人一起探讨吧!