|
应用系统中的数据源通常配置在程序中，或者在应用服务器中配置JDNI数据源，在程序中引用。相对来说在应用服务器中配置JNDI数据源更好一点，因为这样一来，数据源变更之后不用修改程序，只要修改应用服务器中JNDI配置即可。在配置数据源的时候，我们经常会看见有很多人将数据源的密码配置成明文的。这样其实不太安全。因为稍有这个常识的人就可以去查看你的配置文件，这样就能够知道你的数据库的用户名和密码。所以我们需要将数据源的密码进行加密处理，即使别人找到你的配置文件，也不知道数据库的密码是多少。
今天介绍JBoss中JNDI数据源的密码加密方法。
应用服务器：JBoss-5.1.0.GA
数据库：Oracle 10g
假如我们的JBoss安装在D:\jboss-5.1.0.GA下，首先将D:\jboss-5.1.0.GA\server\default\deploy\management\console-mgr.sar\web-console.war\applet.jar文件复制到D:\jboss-5.1.0.GA\common\lib
下。然后在D:\jboss-5.1.0.GA\server\default\deploy\目录下创建一个oracle-ds.xml
文件，用于配置针对Oracle的数据源。该文件在Jboss中是有模板的，在D:\jBoss5.1\docs\examples\jca目录下，里边除过Oracle的数据源模板文件之外，还有db2、informix、mssql、mysql等的数据源模板文件。大家找到以后复制到D:\jboss-5.1.0.GA\server\default\deploy\目录下，然后修改一下即可，不用从头开始创建文件。
修改oracle-ds.xml
文件，去掉里边的user-name和password节点，增加security-domain节点，具体内容如下所示：
<?xml version="1.0" encoding="UTF-8"?>
<!-- ===================================================================== -->
<!-- -->
<!-- JBoss Server Configuration -->
<!-- -->
<!-- ===================================================================== -->
<!-- See http://www./community/wiki/Multiple1PC for information about local-tx-datasource -->
<!-- $Id: oracle-ds.xml 97536 2009-12-08 14:05:07Z jesper.pedersen $ -->
<!-- ==================================================================== -->
<!-- Datasource config for Oracle originally from Steven Coy -->
<!-- ==================================================================== -->
<datasources>
<local-tx-datasource>
<jndi-name>ibankDs</jndi-name>
<!-- 有了这句, 在jndi前可以不用加前缀"java:"
<use-java-context>false</use-java-context>
-->
<!-- 开发环境 -->
<connection-url>jdbc:oracle:thin:@10.1.84.1:1521:ycdvlp</connection-url>
<!-- 测试环境
<connection-url>jdbc:oracle:thin:@10.1.5.152:1521:yctest</connection-url>
-->
<!--
Here are a couple of the possible OCI configurations.
For more information, see http://otn.oracle.com/docs/products/oracle9i/doc_library/release2/java.920/a96654/toc.htm
<connection-url>jdbc:oracle:oci:@youroracle-tns-name</connection-url>
or
<connection-url>jdbc:oracle:oci:@(description=(address=(host=youroraclehost)(protocol=tcp)(port=1521))(connect_data=(SERVICE_NAME=yourservicename)))</connection-url>
Clearly, its better to have TNS set up properly.
-->
<!--
<driver-class>oracle.jdbc.OracleDriver</driver-class>
-->
<driver-class>oracle.jdbc.driver.OracleDriver</driver-class>
<!-- 如果使用加密后的数据库用户密码的话, 则下边的两个节点不需要, 将其配置在login-config.xml文件中. 去掉user-name和password节点, 增加security-domain节点.
<user-name>ibank_new</user-name>
<password>passw0rd!</password>
-->
<!-- 下边配置的是%JBOSS_HOME%\server\default\conf\login-config.xml文件中的application-policy的值 -->
<security-domain>ibankEncryptDBPassword</security-domain>
<min-pool-size>5</min-pool-size>
<max-pool-size>200</max-pool-size>
<!-- Uses the pingDatabase method to check a connection is still valid before handing it out from the pool -->
<!--valid-connection-checker-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleValidConnectionChecker</valid-connection-checker-class-name-->
<!-- Checks the Oracle error codes and messages for fatal errors -->
<exception-sorter-class-name>org.jboss.resource.adapter.jdbc.vendor.OracleExceptionSorter</exception-sorter-class-name>
<!-- sql to call when connection is created
<new-connection-sql>some arbitrary sql</new-connection-sql>
-->
<!-- sql to call on an existing pooled connection when it is obtained from pool - the OracleValidConnectionChecker is prefered
<check-valid-connection-sql>some arbitrary sql</check-valid-connection-sql>
-->
<!-- corresponding type-mapping in the standardjbosscmp-jdbc.xml (optional) -->
<metadata>
<type-mapping>Oracle9i</type-mapping>
</metadata>
</local-tx-datasource>
</datasources>
security-domain节点的值和login-config.xml文件中的application-policy节点的值相同。下来我们就来配置login-config.xml文件。
在D:\jboss-5.1.0.GA\server\default\conf\目录下有一个login-config.xml文件，在里边添加一个application-policy节点。在这个文件里边有很多application-policy节点，找一个复制修改一下。该文件的具体内容如下所示：
<?xml version="1.0"?>
<!-- The XML based JAAS login configuration read by the
org.jboss.security.auth.login.XMLLoginConfig mbean. Add
an application-policy element for each security domain.
The outline of the application-policy is:
<application-policy name="security-domain-name">
<authentication>
<login-module code="login.module1.class.name" flag="control_flag">
<module-option name = "option1-name">option1-value</module-option>
<module-option name = "option2-name">option2-value</module-option>
...
</login-module>
<login-module code="login.module2.class.name" flag="control_flag">
...
</login-module>
...
</authentication>
</application-policy>
$Id: login-config.xml 87078 2009-04-09 14:23:47Z bstansberry@jboss.com $
$Revision: 87078 $
-->
<policy>
<!-- Used by clients within the application server VM such as
mbeans and servlets that access EJBs.
-->
<application-policy name="client-login">
<authentication>
<login-module code="org.jboss.security.ClientLoginModule"
flag="required">
<!-- Any existing security context will be restored on logout -->
<module-option name="restore-login-identity">true</module-option>
</login-module>
</authentication>
</application-policy>
<!-- Security domains for testing new jca framework -->
<application-policy name="HsqlDbRealm">
<authentication>
<login-module code="org.jboss.resource.security.ConfiguredIdentityLoginModule"
flag="required">
<module-option name="principal">sa</module-option>
<module-option name="userName">sa</module-option>
<module-option name="password"></module-option>
<module-option name="managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=DefaultDS</module-option>
</login-module>
</authentication>
</application-policy>
<!-- Security domains for ibank -->
<application-policy name="ibankEncryptDBPassword">
<authentication>
<login-module code="org.jboss.resource.security.SecureIdentityLoginModule" flag="required">
<module-option name="principal">ibank_new</module-option>
<module-option name="username">ibank_new</module-option> <!-- 数据库用户名 -->
<module-option name="password">64c5fd2979a86168</module-option> <!-- 加密后的数据库用户密码 -->
<!-- 下边的name是%JBOSS_HOME%\server\default\deploy\oracle-ds.xml中jndi-name的值 -->
<module-option name="managedConnectionFactoryName">jboss.jca:service=LocalTxCM,name=ibankDs</module-option>
</login-module>
</authentication>
</application-policy>
<application-policy name="JmsXARealm">
<authentication>
<login-module code="org.jboss.resource.security.ConfiguredIdentityLoginModule"
flag="required">
<module-option name="principal">guest</module-option>
<module-option name="userName">guest</module-option>
<module-option name="password">guest</module-option>
<module-option name="managedConnectionFactoryName">jboss.jca:service=TxCM,name=JmsXA</module-option>
</login-module>
</authentication>
</application-policy>
<!-- A template configuration for the jmx-console web application. This
defaults to the UsersRolesLoginModule the same as other and should be
changed to a stronger authentication mechanism as required.
-->
<application-policy name="jmx-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required">
<module-option name="usersProperties">props/jmx-console-users.properties</module-option>
<module-option name="rolesProperties">props/jmx-console-roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
<!-- A template configuration for the web-console web application. This
defaults to the UsersRolesLoginModule the same as other and should be
changed to a stronger authentication mechanism as required.
-->
<application-policy name="web-console">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required">
<module-option name="usersProperties">web-console-users.properties</module-option>
<module-option name="rolesProperties">web-console-roles.properties</module-option>
</login-module>
</authentication>
</application-policy>
<!--
A template configuration for the JBossWS security domain.
This defaults to the UsersRolesLoginModule the same as other and should be
changed to a stronger authentication mechanism as required.
-->
<application-policy name="JBossWS">
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required">
<module-option name="usersProperties">props/jbossws-users.properties</module-option>
<module-option name="rolesProperties">props/jbossws-roles.properties</module-option>
<module-option name="unauthenticatedIdentity">anonymous</module-option>
</login-module>
</authentication>
</application-policy>
<!-- The default login configuration used by any security domain that
does not have a application-policy entry with a matching name
-->
<application-policy name="other">
<!-- A simple server login module, which can be used when the number
of users is relatively small. It uses two properties files:
users.properties, which holds users (key) and their password (value).
roles.properties, which holds users (key) and a comma-separated list of
their roles (value).
The unauthenticatedIdentity property defines the name of the principal
that will be used when a null username and password are presented as is
the case for an unuathenticated web client or MDB. If you want to
allow such users to be authenticated add the property, e.g.,
unauthenticatedIdentity="nobody"
-->
<authentication>
<login-module code="org.jboss.security.auth.spi.UsersRolesLoginModule"
flag="required"/>
</authentication>
</application-policy>
</policy>
application-policy节点中的name属性的值和oracle-ds.xml
文件中的security-domain节点的值相同。application-policy下的name属性为“username”的module-option节点的值是数据源的用户名，name属性为“password”的module-option节点的值是数据源的加密后的密码，注意该处的密码是密文的，不是明文。
下来我们看如何加密数据源密码。
假如数据源密码是123456，启动cmd命令窗口，在里边执行如下命令：
java -cp "D:\jBoss5.1\common\lib\jbosssx.jar;D:\jBoss5.1\common\lib\applet.jar" org.jboss.resource.security.SecureIdentityLoginModule 123456
最后的参数是数据源的密码。执行后界面显示如下内容：
Encoded password: 64c5fd2979a86168
后边的“64c5fd2979a86168”既是加密后的密码，将该值放在login-config.xml
文件的application-policy下name属性为“password”的module-option节点中即可。
|
