16.5. Replace clear text passwords with their password masks

Clear text passwords in XML configuration files can be replaced with password masks by changing the property assignment for an annotation. Generate password masks for any clear text password that you wish to mask in Microcontainer bean configuration files by following Procedure 16.4, “Create password masks”. Then replace the configuration occurrence of each clear text password with an annotation referencing its mask.

The general form of the annotation is:

<annotation>@org.jboss.security.integration.password.Password(securityDomain=MASK_NAME, methodName=setPROPERTY_NAME)</annotation>

As a concrete example, the JBoss Messaging password is stored in the server profile in the file deploy/messaging/messaging-jboss-beans.xml. If you create a password mask named "messaging", then the before and after snippet of the configuration file looks like this:

<property name="suckerPassword">CHANGE ME!!</property>

<annotation>@org.jboss.security.integration.password.Password(securityDomain=messaging,
methodName=setSuckerPassword)</annotation>