Red Hat Summit Red Hat Summitサポートコンソール開発者トライアルの開始お問い合わせ

このコンテンツは選択した言語では利用できません。

Chapter 17. Encrypting Data Source Passwords

Database connections for the JBoss Enterprise Application Platform are defined in *-ds.xml data source files. These database connection details include clear text passwords. You can increase the security of your server by replacing clear text passwords in data source files with encrypted passwords.
This chapter presents two different methods for encrypting data source passwords.
Secured Identity using the module SecureIdentityLoginModule is described in Section 17.1, “Secured Identity”.
Configured Identity with Password Based Encryption using the module JaasSecurityDomainIdentityLoginModule is described in Section 17.1, “Secured Identity”.

17.1. Secured Identity
リンクのコピー

The class org.jboss.resource.security.SecureIdentityLoginModule can be used to both encrypt database passwords and to provide a decrypted version of the password when the data source configuration is required by the server. The SecureIdentityLoginModule uses a hard-coded password to encrypt/decrypt the data source password.

Procedure 17.1. Overview: Using SecureIdentityLoginModule to encrypt a data source password

  1. Encrypt the data source password.
  2. Create an application authentication policy with the encrypted password.
  3. Configure the data source to use the application authentication policy.

17.1.1. Encrypt the data source password
リンクのコピー

The data source password is encrypted using the SecureIdentityLoginModule main method by passing in the clear text password. The SecureIdentityLoginModule is provided by jbosssx.jar.

Procedure 17.2. Encrypt a data source password - Platform versions 5.0 and 5.0.1

This procedure encrypts a data source password on JBoss Enterprise Application Platform versions 5.0 and 5.0.1
  1. Change directory to the jboss-as directory
  2. Invoke the SecureIdentityLoginModule with the following command, supplying the clear text password as PASSWORD:
    Linux command

    java -cp client/jboss-logging-spi.jar:common/lib/jbosssx.jar \ 
org.jboss.resource.security.SecureIdentityLoginModule PASSWORD
    Copy to Clipboard Toggle word wrap

    Windows command:

    java -cp client\jboss-logging-spi.jar;common\lib\jbosssx.jar \
 org.jboss.resource.security.SecureIdentityLoginModule PASSWORD
    Copy to Clipboard Toggle word wrap

    Result:

    The command will return an encrypted password.

Procedure 17.3. Encrypt a data source password - Platform version 5.1 and later

This procedure encrypts a data source password on JBoss Enterprise Application Platform versions 5.1 and later
  1. Change directory to the jboss-as directory
  2. Linux command

    java -cp client/jboss-logging-spi.jar:lib/jbosssx.jar \
 org.jboss.resource.security.SecureIdentityLoginModule PASSWORD
    Copy to Clipboard Toggle word wrap

    Windows command:

    java -cp client\jboss-logging-spi.jar;lib\jbosssx.jar \
 org.jboss.resource.security.SecureIdentityLoginModule PASSWORD
    Copy to Clipboard Toggle word wrap

    Result:

    The command will return an encrypted password.

17.1.2. Create an application authentication policy with the encrypted password
リンクのコピー

Each JBoss Application Server server profile has a conf/login-config.xml file, where application authentication policies are defined for that profile. To create an application authentication policy for your encrypted password, add a new <application-policy> element to the <policy> element.
Example 17.1, “Example application authentication policy with encrypted data source password” is a fragment of a login-config.xml file showing an application authentication policy of name "EncryptDBPassword".

Example 17.1. Example application authentication policy with encrypted data source password

  
  <policy>
  ...
      <!-- Example usage of the SecureIdentityLoginModule -->
      <application-policy name="EncryptDBPassword">
          <authentication>
              <login-module code="org.jboss.resource.security.SecureIdentityLoginModule" flag="required">
                  <module-option name="username">admin</module-option>
                  <module-option name="password">5dfc52b51bd35553df8592078de921bc</module-option>
                  <module-option name="managedConnectionFactoryName">jboss.jca:name=PostgresDS,service=LocalTxCM</module-option>
              </login-module>
          </authentication>
      </application-policy>
  </policy>
Copy to Clipboard Toggle word wrap

SecureIdentityLoginModule module options

user name
Specify the user name to use when establishing a connection to the database.
password
Provide the encrypted password generated in Section 17.1.1, “Encrypt the data source password”.
managedConnectionFactoryName
jboss.jca:name
Nominate a Java Naming and Directory Interface (JNDI) name for this data source.
jboss.jca:service
Specify the transaction type

Transaction types

NoTxCM
No transaction support
LocalTxCM
Single resource transaction support
TxCM
Single resource or distributed transaction support
XATxCM
Distributed transaction support

17.1.3. Configure the data source to use the application authentication policy
リンクのコピー

At run-time the application policy is bound to JNDI under the application policy name, and is made available as a security domain.
The data source is configured in a *-ds.xml file. Remove the <user-name> and <password> elements from this file, and replace them with a <security-domain> element. This element will contain the application authentication policy name specified following Section 17.1.2, “Create an application authentication policy with the encrypted password”.
Using the example name from Section 17.1.2, “Create an application authentication policy with the encrypted password”, "EncryptDBPassword", will result in a data source file that looks something like Example 17.2, “Example data source file using secured identity”.

Example 17.2. Example data source file using secured identity

<?xml version="1.0" encoding="UTF-8"?>
<datasources>
    <local-tx-datasource>
        <jndi-name>PostgresDS</jndi-name>
        <connection-url>jdbc:postgresql://127.0.0.1:5432/test?protocolVersion=2</connection-url>
        <driver-class>org.postgresql.Driver</driver-class>
        <min-pool-size>1</min-pool-size>
        <max-pool-size>20</max-pool-size>

        <!-- REPLACED WITH security-domain BELOW
        <user-name>admin</user-name>
        <password>password</password>
        -->

        <security-domain>EncryptDBPassword</security-domain>

        <metadata>
            <type-mapping>PostgreSQL 8.0</type-mapping>
        </metadata>
    </local-tx-datasource>
</datasources>
Copy to Clipboard Toggle word wrap
トップに戻る
Red Hat logoGithubredditYoutubeTwitter

詳細情報

試用、購入および販売

コミュニティー

Red Hat ドキュメントについて

Red Hat をお使いのお客様が、信頼できるコンテンツが含まれている製品やサービスを活用することで、イノベーションを行い、目標を達成できるようにします。 最新の更新を見る.

多様性を受け入れるオープンソースの強化

Red Hat では、コード、ドキュメント、Web プロパティーにおける配慮に欠ける用語の置き換えに取り組んでいます。このような変更は、段階的に実施される予定です。詳細情報: Red Hat ブログ.

会社概要

Red Hat は、企業がコアとなるデータセンターからネットワークエッジに至るまで、各種プラットフォームや環境全体で作業を簡素化できるように、強化されたソリューションを提供しています。

Theme

© 2025 Red Hat