You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@karaf.apache.org by Vince Iglehart <vi...@kniferiver.com> on 2016/10/03 15:34:26 UTC
Karaf Datasource Passwords
Hello,
I am using Karaf version 4.0.5 with Camel 2.17.3. I need to create a
datasource with the password encrypted and not available to the end user. I
understand there are two ways to create a datasource in Karaf.
1. Use BluePrint - create an XML file and specify an encrypted password
using Jasypt.
2. Using Pax JDBC - create a .cfg file and specify clear text password.
I understand option 2 is the new and preferred way to create datasources as
option 1 is now deprecated.
My question is how do I hide the password for option 2 so that it is
encrypted and does not show up when executing ==> service:list
javax.sql.DataSource.
I read on osp4j that hidden properties are supported:
https://ops4j1.jira.com/wiki/display/PAXJDBC/Create+DataSource+from+config
Therefore I can prepend the password property with a period inside of the
.cfg file, and it would hide the password. However when I do that, the
datasource doesn't get created.
Thanks
--
View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219.html
Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Vince Iglehart <vi...@kniferiver.com>.
Benjamin,
I think I have it now. I am able to connect using Pax JDBC Config. I am
working on a proof of concept project and I am fairly new to Karaf. I was
trying to merge several resources I found on the web and I was getting
confused.
Here are the resources I used:
http://www.liquid-reality.de/display/liquid/2012/01/13/Apache+Karaf+Tutorial+Part+6+-+Database+Access
http://blog.nanthrax.net/2014/10/encrypt-configadmin-properties-values-in-apache-karaf/
For others interested, here is what I did to make it all work.
1. I installed Jasypt into Karaf ==> feature:install jasypt-encryption
2. I added a jasypt_encryption.xml file to the deploy directory of the Karaf
installation.
3. I created a datasource_.cfg file with an encoded password signified by
using the ENC() specification.
The jasypt_encryption.xml is what created the service using the encryption
options that I selected.
The datasource_.cfg file defined the datasource that I needed. Note: other
features are needed when using Pax datasources. These are specified in the
links above.
I hope this helps others new to Pax JDBC in Karaf.
--
View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219p4048263.html
Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Benjamin Graf <be...@gmx.net>.
Hi Vince,
you are mixing up stuff. You're encryptor in this case works as an
extension to the defined property placeholder. Your're trying to decrypt
the properties to initialize the encryptor. Split up the encryptor stuff
and the datasource stuff. Register a osgi service for StringEncryptor as
shown in my last answer and than do the register the datasource with
pax-jdbc-config. Pax-jdbc-config is looking for a registered service it
can use for decryption. This way you can share the encryptor for several
datasource definitions.
Regards,
Benjamin
Am 05.10.2016 um 23:06 schrieb Vince Iglehart:
> Benjamin,
>
> I implemented your suggestion. I think that I am fairly close, yet running
> into some problems.
>
> When I attempt to connect to use the datasource, I receive ORA-01017:
> invalid username/password; logon denied. I think the problem is because I
> pull the password for Jasypt into a separate jasypt.properties file that
> will be accessible only to the user running Karaf. However I don't know how
> to fix that.
>
> The following blueprint shows what I have for my datasource.
>
> Would you have any other advice?
>
>
>
> <?xml version="1.0" encoding="UTF-8"?>
>
> <blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
> xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0"
> xmlns:enc="http://karaf.apache.org/xmlns/jasypt/v1.0.0">
>
>
> <ext:property-placeholder>
> <ext:location>file:/oracle/jasypt.properties</ext:location>
> </ext:property-placeholder>
>
> <enc:property-placeholder>
> <enc:encryptor
> class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
> <property name="config">
> <bean class="org.jasypt.encryption.pbe.config.SimplePBEConfig">
>
>
>
> <property name="algorithm" value="${jasaypt.algorithm}" />
> <property name="password" value="${jasaypt.encryption.password}"
> />
> </bean>
> </property>
> </enc:encryptor>
> </enc:property-placeholder>
>
> <bean id="dataSource" class="oracle.jdbc.pool.OracleDataSource">
> <property name="URL" value="<url specified here>"/>
> <property name="user" value="<user name here>"/>
> <property name="password" value="ENC(<encrypted
> value here>)" />
> </bean>
>
> <service interface="javax.sql.DataSource" ref="dataSource">
> <service-properties>
> <entry key="osgi.jndi.service.name" value="jdbc/oracleds"/>
> </service-properties>
> </service>
> </blueprint>
>
>
>
> --
> View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219p4048251.html
> Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Vince Iglehart <vi...@kniferiver.com>.
Benjamin,
I implemented your suggestion. I think that I am fairly close, yet running
into some problems.
When I attempt to connect to use the datasource, I receive ORA-01017:
invalid username/password; logon denied. I think the problem is because I
pull the password for Jasypt into a separate jasypt.properties file that
will be accessible only to the user running Karaf. However I don't know how
to fix that.
The following blueprint shows what I have for my datasource.
Would you have any other advice?
<?xml version="1.0" encoding="UTF-8"?>
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"
xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0"
xmlns:enc="http://karaf.apache.org/xmlns/jasypt/v1.0.0">
<ext:property-placeholder>
<ext:location>file:/oracle/jasypt.properties</ext:location>
</ext:property-placeholder>
<enc:property-placeholder>
<enc:encryptor
class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
<property name="config">
<bean class="org.jasypt.encryption.pbe.config.SimplePBEConfig">
<property name="algorithm" value="${jasaypt.algorithm}" />
<property name="password" value="${jasaypt.encryption.password}"
/>
</bean>
</property>
</enc:encryptor>
</enc:property-placeholder>
<bean id="dataSource" class="oracle.jdbc.pool.OracleDataSource">
<property name="URL" value="<url specified here>"/>
<property name="user" value="<user name here>"/>
<property name="password" value="ENC(<encrypted
value here>)" />
</bean>
<service interface="javax.sql.DataSource" ref="dataSource">
<service-properties>
<entry key="osgi.jndi.service.name" value="jdbc/oracleds"/>
</service-properties>
</service>
</blueprint>
--
View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219p4048251.html
Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Benjamin Graf <be...@gmx.net>.
Hi Vince,
you still need do define and register a StringEncryptor service.
Try something like that: (doc: http://www.jasypt.org)
<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0">
<bean id="stringEncryptor"
class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">
<property name="config">
<bean
class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">
<property name="algorithm" value="PBEWithMD5AndDES"/>
<property name="passwordEnvName"
value="ENCRYPTION_PASSWORD"/>
</bean>
</property>
</bean>
<service ref="stringEncryptor"
interface="org.jasypt.encryption.StringEncryptor"/>
</blueprint>
Regards
Benjamin
Am 03.10.2016 um 21:29 schrieb Vince Iglehart:
> JB,
> That helps, but I'm having trouble connecting the pieces. I ran the
> following command in Karaf:
>
> feature:install jasypt-encription
>
>
> Now I go into the etc/org.ops4j.datasource-mydatasource.cfg . I
> understand that I should change the password property as follows:
>
> password=ENC(encryptedvaluehere)
>
> Is my understanding correct? How do I get the encrypted value to enter in
> the file?
>
> Please advise
>
>
>
> --
> View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219p4048225.html
> Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Vince Iglehart <vi...@kniferiver.com>.
JB,
That helps, but I'm having trouble connecting the pieces. I ran the
following command in Karaf:
feature:install jasypt-encription
Now I go into the etc/org.ops4j.datasource-mydatasource.cfg . I
understand that I should change the password property as follows:
password=ENC(encryptedvaluehere)
Is my understanding correct? How do I get the encrypted value to enter in
the file?
Please advise
--
View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219p4048225.html
Sent from the Karaf - User mailing list archive at Nabble.com.
Re: Karaf Datasource Passwords
Posted by Jean-Baptiste Onofré <jb...@nanthrax.net>.
Hi Vince,
you can take a look on:
http://blog.nanthrax.net/2014/10/encrypt-configadmin-properties-values-in-apache-karaf/
Actually, you can mix both.
Does it help ?
Regards
JB
On 10/03/2016 05:34 PM, Vince Iglehart wrote:
> Hello,
> I am using Karaf version 4.0.5 with Camel 2.17.3. I need to create a
> datasource with the password encrypted and not available to the end user. I
> understand there are two ways to create a datasource in Karaf.
>
> 1. Use BluePrint - create an XML file and specify an encrypted password
> using Jasypt.
> 2. Using Pax JDBC - create a .cfg file and specify clear text password.
>
> I understand option 2 is the new and preferred way to create datasources as
> option 1 is now deprecated.
>
> My question is how do I hide the password for option 2 so that it is
> encrypted and does not show up when executing ==> service:list
> javax.sql.DataSource.
>
> I read on osp4j that hidden properties are supported:
> https://ops4j1.jira.com/wiki/display/PAXJDBC/Create+DataSource+from+config
>
> Therefore I can prepend the password property with a period inside of the
> .cfg file, and it would hide the password. However when I do that, the
> datasource doesn't get created.
>
> Thanks
>
>
>
> --
> View this message in context: http://karaf.922171.n3.nabble.com/Karaf-Datasource-Passwords-tp4048219.html
> Sent from the Karaf - User mailing list archive at Nabble.com.
>
--
Jean-Baptiste Onofr
jbonofre@apache.org
http://blog.nanthrax.net
Talend - http://www.talend.com