1

We have a batch application using OpenJPA. We are specifying all the DB connection parameters in persistence.xml. Although its a functional setup it looks very insecure to have all the ip,username,password in clear text and a serious concern in production.

As it is a standalone batch app we cant use server configurations etc. Is there a way to may JPA read the properties from an encrypted file...or at the least something like MD5 hashing the parameter values?

skaffman
  • 398,947
  • 96
  • 818
  • 769
Barun
  • 503
  • 5
  • 13
  • 22

1 Answers1

3

At least passwords can be encrypted. Since OpenJPA 1.3.0 your can set an EncryptionProvider in OpenJPAConfiguration. See also the manual.

Tim Bender
  • 20,112
  • 2
  • 49
  • 58
Markus Knittig
  • 631
  • 5
  • 8
  • Thanks Markus. Very helpful. Its a start. Unfortunately we use v1.2. Still I will look into that...maybe there are other improvements also. Looking back, encryption support should have a primary feature, don't you think? – Barun Feb 21 '10 at 15:43
  • Well, JPA is still probably mostly used in container environments, so the use case isn't that common. OpenJPA 2.x (aka 1.3) isn't released yet (only the beta), but the new feature (mostly support for JPA 2) look very promising... – Markus Knittig Feb 21 '10 at 16:04
  • The url to the manual gives a 404. The current url should be: http://openjpa.apache.org/builds/latest/docs/docbook/manual.html#ref_guide_encryption – Saïd Sep 27 '12 at 22:10