JBoss AS 7.1 - datasource how to encrypt password

Question

In JBoss AS 5, I have a datasource defined in *-ds.xml but put username/encrypted password in *-jboss-beans.xml.

Now in JBoss AS 7.1, the datasource is defined in standalone.xml or domain.xml. Where do I put the encrypted password in AS 7.1?

In other words, how is a clear password encrypted and secured in AS 7?

Answer 1

In AS7 you can use the SecureIdentityLoginModule to add an encrypted password domain. For instance, you can define a security domain in standalone.xml or domain.xml:

<security-domain name="EncryptedPassword">
  <authentication>
    <login-module code="SecureIdentity" flag="required">
      <module-option name="username" value="test"/>
      <module-option name="password" value="encrypted_password"/>
    </login-module>
  </authentication>
</security-domain>

Then you can add this security domain in your particular data source that uses this userid/pwd combination in standalone.xml or domain.xml:

  <datasource ... >
       .....
       <security>
              <security-domain>EncryptedPassword</security-domain>
       </security>
  </datasource>

To encrypt the password itself, you can run this command (please verify the versions of picketbox jar and logging jar in your particular AS7 download to substitute accordingly):

java -cp $JBOSS_HOME/modules/org/picketbox/main/picketbox-4.0.6.<beta|final>.jar:$JBOSS_HOME/modules/org/jboss/logging/main/jboss-logging-3.1.0.<some_version>.jar:$CLASSPATH org.picketbox.datasource.security.SecureIdentityLoginModule password

This will return an encrypted password back that you can use in your security domain.

You can read more about JBoss AS7 security subsystem here. Since open source rocks, you can see how the encoding code works in the source code of SecureIdentityLogin. You will notice in the source code that it uses Blowfish for encryption.