Question

I am working on an application that will be used by schools. Each school will set up their on database. And each school will provide their own “settings” file to the application. The settings file will contain the database url for the specific school who made the settings file. This is so that a student using the application can just load a different settings file if they want to connect to a different database.

My question is, how do i protect the username and password used to connect to the database? So, that ONLY the application has read and write access to the database. And the application has read and write access to only that specific school?

If you need more information, please let me know.

Thanks

Answer 1

Take a look at Jasypt, it is a java library which allows the developer to add basic encryption capabilities to his/her projects with minimum effort, and without the need of having deep knowledge on how cryptography works.

In case you use Spring, you can define your db.properties as:

 jdbc.driver=com.mysql.jdbc.Driver
 jdbc.url=jdbc:mysql://localhost/yourdb
 jdbc.username=userName
 jdbc.password=ENC(A6L729KukPEx7Ps8didIUWb01fdBRh7d)

and configure it with Jasypt and Spring as:

<bean class="org.jasypt.spring.properties.EncryptablePropertyPlaceholderConfigurer">
   <constructor-arg>
     <bean class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
       <property name="config">
         <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
           <property name="algorithm" value="PBEWithMD5AndDES" />
           <property name="passwordEnvName" value="APP_ENCRYPTION_PASSWORD" />
         </bean>
       </property>
     </bean>
   </constructor-arg>
   <property name="locations">
     <list>
       <value>classpath:/META-INF/props/db/db.properties</value>
     </list>
   </property>   
</bean>

<bean id="dataSource" class="org.apache.commons.dbcp.BasicDataSource">
    <property name="driverClassName" value="${jdbc.driverClassName}"/>
    <property name="url" value="${jdbc.url}"/>
    <property name="username" value="${jdbc.username}"/>
    <property name="password" value="${jdbc.password}"/>
</bean>

This would hide the actual password (you can do the same for the username) from students, so they would not be able to derive the connection string from looking at the properties file.

In case you are not using Spring, here is a Jasypt guide to achive the same “manually”