Spring database config security

[Lu Battist]

I'd like to use Spring framework for dataSource configuration but have a requirement to not store any passwords in clear text.

Is there a way for Spring to handle this, or for me to handle this by subclassing something, so it unencrypts the password given in the config file before attempting to establish the database connection?

Snippet:

  <bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource" destroy-method="close">
    <property name="driverClassName" value="COM.ibm.db2.jdbc.app.DB2Driver" />
    <property name="url" value="jdbc :mrgreen: b2 :mrgreen: B005" />
    <property name="username" value="appDbId" />
    <property name="password" value="encrypted_password" />
  </bean>

[Jason Moors]

You could extend the

org.springframework.beans.factory.config.PropertyPlaceholderConfigurer 

class which allows you to load configuration values from a property file. I think all you would need to do is override the method

    
protected String resolvePlaceholder(String placeholder, Properties props, int systemPropertiesMode)

to retrieve the value from the property file and decrypt. Then in your xml config add the following bean (replace the class with your extended classes)

    
<bean id="propertyConfigurer" class="org.springframework.beans.factory.config.PropertyPlaceholderConfigurer">
  <property name="location">
    <value>name of property file</value>
  </property>
</bean>
 
<bean id="dataSource" class="org.springframework.jdbc.datasource.DriverManagerDataSource" destroy-method="close">    
<property name="driverClassName" value=[B]${database.driver}[/B] />    
<property name="url" value=[B]${database.url}[/B] />    
<property name="username" value=[B]${database.username}[/B] />        
<property name="password" value=[B]${database.password}[/B] />  </bean>
 

Then create the property file

database.url=encrypted_value
database.driver=encrypted_value
database.user=encrypted_value
database.password=encrypted_value
 

Another option would be investigate configuring the DataSource within your J2EE server and using JNDI to access the datasource.

regards

Jason

[ March 09, 2006: Message edited by: Jason Moors ]
[ March 09, 2006: Message edited by: Jason Moors ]