I am using JPA2.0 (Eclipselink) to interact with DB and I have persistence.xml file which has some DB configuration. I want to obscure the password used for accessing DB. I am using eclipse IDE. The following config tags are used in persistence.xml file.
<property name="javax.persistence.jdbc.user" value="app"/>
<property name="javax.persistence.jdbc.password" value="password"/>
I don’t want to mention the password here in xml. How do I go about it?
Note: My application is composed of Swing with Apache’s Derby Embedded DB.
You could let the server store the password and then you can retrieve it using
JNDI.It would also be possible to encrypt the password, and decrypt in the client. Although this would be susceptible to dictionary attacks, or even straight out reversing the process by decompiling your program.