1

I am working on an application that will be used by schools. Each school will set up their on database. And each school will provide their own "settings" file to the application. The settings file will contain the database url for the specific school who made the settings file. This is so that a student using the application can just load a different settings file if they want to connect to a different database.

My question is, how do i protect the username and password used to connect to the database? So, that ONLY the application has read and write access to the database. And the application has read and write access to only that specific school?

If you need more information, please let me know.

Thanks

prolink007
  • 33,872
  • 24
  • 117
  • 185
  • so your application is webapp or desktop application? you want to encrypt the password in the application ? the setting file just containing the DB URL but no user/password information, right ? btw, you can create database user for a particular db, all database are inside the same db server – Tommy Oct 11 '11 at 03:28
  • desktop, i want to protect the user name and password used by the application to authenticate to the database, the settings file only contains the db url. The application username and password is used to give the application read/write privileges in the DB. – prolink007 Oct 11 '11 at 03:34

1 Answers1

2

Take a look at Jasypt, it is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

In case you use Spring, you can define your db.properties as:

 jdbc.driver=com.mysql.jdbc.Driver
 jdbc.url=jdbc:mysql://localhost/yourdb
 jdbc.username=userName
 jdbc.password=ENC(A6L729KukPEx7Ps8didIUWb01fdBRh7d)

and configure it with Jasypt and Spring as:

<bean class="org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer">
   <constructor-arg>
     <bean class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
       <property name="config">
         <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
           <property name="algorithm" value="PBEWithMD5AndDES" />
           <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
         </bean>
       </property>
     </bean>
   </constructor-arg>
   <property name="locations">
     <list>
       <value>classpath:/META-INF/props/db/db.properties</value>
     </list>
   </property>   
</bean>

<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
    <property name="driverClassName" value="${jdbc.driverClassName}"/>
    <property name="url" value="${jdbc.url}"/>
    <property name="username" value="${jdbc.username}"/>
    <property name="password" value="${jdbc.password}"/>
</bean>

This would hide the actual password (you can do the same for the username) from students, so they would not be able to derive the connection string from looking at the properties file.

In case you are not using Spring, here is a Jasypt guide to achive the same "manually"

tolitius
  • 22,149
  • 6
  • 70
  • 81
  • I am not sure what spring is, but this is strictly a desktop application. does that mean I will have to do the manual version you mentioned? – prolink007 Oct 11 '11 at 04:18
  • @prolink007, it does not really matter whether it is a desktop application, a web app or a daemon. You can still use Spring if you'd like. Take a look at the [doc](http://static.springsource.org/spring/docs/3.1.x/spring-framework-reference/htmlsingle/spring-framework-reference.html) it may be overwhelming at first, since Spring does lots and lots of cool things. However if it is not something you are looking to learn at the moment, encrypting credentials "by hand" with Jasypt various password encryptors ( e.g. BasicPasswordEncryptor, StrongPasswordEncryptor, etc. ) is also a quite solid option – tolitius Oct 11 '11 at 04:28