Re: Encrypt password in JDBC connection string

is it a web app?  if so, use a JDBC data source defined by the app server.  i 
think all the app servers i have seen have some form/mechanism to encrypt or 
use indirection for the password in the data-sources.xml file that defines the 
connection url.

For oc4j:
Using Password Indirection The data-sources.xml file requires passwords for 
authentication. Embedding these passwords without some kind of obfuscation 
poses a security risk. To avoid this problem, OC4J supports password 
indirection.
 An indirect password is made up of a special indirection symbol (->) and a 
user name (or user name and realm). When OC4J encounters an indirect password, 
it retrieves the password associated with the specified user from the security 
store provided by a user manager.
 For more information on creating users and passwords, and working with a user 
manager, see the section on password management in the Oracle Containers for 
J2EE Security Guide.
 For example, if the native data source entry looks like:
 
<native-data-source
   name="nativeDataSource"
   jndi-name="jdbc/nativeDS"
   data-source-class="com.acme.DataSourceImpl"
   user="frank"
   password="frankpw"
   url="jdbc:acme:@localhost:5500:acme" />
 

 You can replace the password, "frankpw", with the indirection symbol (->) and 
a user name (frank) as follows: password="->frank". This assumes that a user 
named frank with the password frankpw has been created in a user manager.
 You can configure password indirection in the Application Server Control 
Console.
 To configure an indirect password for a data source directly in the 
data-sources.xml file and change the value of the password attribute so that 
its value is "->", followed either by the username or by the realm and user 
separated by a slash ("/"). For example:
 
<native-data-source
   name="nativeDataSource"
   jndi-name="jdbc/nativeDS"
   data-source-class="com.acme.DataSourceImpl"
   user="frank"
   password="->frank"
   url="jdbc:acme:@localhost:5500:acme" />


 There is also a password attributes for <managed-data-source> and 
<connection-factory> elements
goran bogdanovic <goran00@xxxxxxxxx> wrote: 
You may consider to use Oracle Secure External Password Store...

 
 Wu, Michael wrote:    
Hello,

Our technical auditors require we encrypt the schema password in the JDBC 
connection string. Can you please provide some advice? What's the best practice 
to handle those application schema password in Oracle?


Thanks,
Michael 


 

       
---------------------------------
Ready for the edge of your seat? Check out tonight's top picks on Yahoo! TV.

Other related posts: