You are viewing a plain text version of this content. The canonical link for it is here.
Posted to user@shiro.apache.org by "richard@localmed.com" <ri...@localmed.com> on 2013/05/22 23:59:22 UTC
How to secure database password in shiro.ini?
Hi.
Following some examples I found in the forum here along with the Shiro
documentation, I have successfully set up a JdbcRealm in my shiro.ini as
follows:
# User realm configuration.
userRealm=org.apache.shiro.realm.jdbc.JdbcRealm
userRealm.authenticationQuery = SELECT password FROM users WHERE username =
?
userRealm.userRolesQuery = SELECT role FROM roles WHERE username = ?
userRealm.permissionsQuery = SELECT permission FROM permissions WHERE role =
?
# User database configuration.
ds = com.mysql.jdbc.jdbc2.optional.MysqlDataSource
ds.serverName = localhost
ds.user = shiro
ds.password = *[redacted]*
ds.databaseName = shiro_schema
userRealm.dataSource = $ds
# Realm configuration.
securityManager.realms = $userRealm
That much seems straightforward, but notice that the plaintext password for
the database would appear in the shiro.ini file. I would prefer not to
store the password there, for obvious reasons including not wanting to check
a password into version control.
Is there a way to specify that the password should be looked up from a
separate file or, even better, a keystore? Or is there a better way to
accomplish the same goal of securing the database password?
Sorry if this ends up being more of a JDBC question that a strictly Shiro
one, but I was having difficulty finding anything relevant in the
documentation.
Thanks for any help.
--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by "richard@localmed.com" <ri...@localmed.com>.
I submitted an improved patch here:
https://issues.apache.org/jira/browse/SHIRO-445
This also takes care of the issue described in:
shiro-user.582556.n2.nabble.com/Best-practice-for-managing-different-shiro-ini-files-for-different-environment-td7579099.html
--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763p7579462.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by Les Hazlewood <lh...@apache.org>.
Great! Thanks for this Richard - patches are always welcome.
Cheers,
--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
On Thu, Jun 6, 2013 at 2:38 PM, richard@localmed.com
<ri...@localmed.com> wrote:
> I submitted an issue and a patch already:
> https://issues.apache.org/jira/browse/SHIRO-445
>
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763p7578816.html
> Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by "richard@localmed.com" <ri...@localmed.com>.
I submitted an issue and a patch already:
https://issues.apache.org/jira/browse/SHIRO-445
--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763p7578816.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by "richard@localmed.com" <ri...@localmed.com>.
I have succeeded in writing a package with extensions to accomplish this
similar to the approach used by shadow password files. Once I have a chance
to go through the http://shiro.apache.org/how-to-contribute.html
documentation, I will look into submitting it.
Thanks again for all you help, Les!
--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763p7578811.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by "richard@localmed.com" <ri...@localmed.com>.
Hi, Les.
Thanks for the pointer. I like this approach, and have spent the day
confirming that I can theoretically get it to work.
I have been perusing the source code trying to figure out how Shiro reads
the shiro.ini file into its configuration, so that I can use something
similar for the password configuration (or at the very least, be able to
locate the configuration file in the same location as shiro.ini). It is
slow going.
As for submitting a patch, I would like to, but I have not even been able to
get the Shiro 1.2.2 source code to build successfully, so that is doubtful
at the moment. If you are curious, "mvn clean compile" fails here, using
Apache Maven 3.0.4:
[ERROR] Failed to execute goal
org.codehaus.mojo:dependency-maven-plugin:1.0:unpack (default) on project
samples-spring: Unknown archiver type: No such archiver:
'1\samples\spring-client\target\classes'. -> [Help 1]
I'll report back next week when I make more progress.
--
View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763p7578792.html
Sent from the Shiro User mailing list archive at Nabble.com.
Re: How to secure database password in shiro.ini?
Posted by Les Hazlewood <lh...@apache.org>.
Hi Richard,
Shiro's ini config doesn't have such functionality out of the box for
objects configured in the [main] section. (It does however support
encrypted passwords in the [users] section to ensure those never need
to be in plain text).
However, a good solution I think is to implement the Factory
interface, e.g. PasswordFactory. For example:
dbPassword = com.foo.shiro.PasswordFactory
dbPassword.credentialsFile = <url or file path>
db.password = $dbPassword
This works because, when evaluating an assignment, Shiro's ini config
checks to see if the value on the right of the equals sign is a
Factory, and if so, uses the value returned from the Factory's
getInstance() method call, not the factory itself. So if your
PasswordFactory#getInstance() return value is the password obtained
from the file, you'll be good.
Finally, if you'd like this functionality to be in Shiro by default,
please open a feature request (and if you implement this, a patch
would be much appreciated!).
HTH,
--
Les Hazlewood | @lhazlewood
CTO, Stormpath | http://stormpath.com | @goStormpath | 888.391.5282
On Wed, May 22, 2013 at 2:59 PM, richard@localmed.com
<ri...@localmed.com> wrote:
> Hi.
>
> Following some examples I found in the forum here along with the Shiro
> documentation, I have successfully set up a JdbcRealm in my shiro.ini as
> follows:
>
> # User realm configuration.
> userRealm=org.apache.shiro.realm.jdbc.JdbcRealm
> userRealm.authenticationQuery = SELECT password FROM users WHERE username =
> ?
> userRealm.userRolesQuery = SELECT role FROM roles WHERE username = ?
> userRealm.permissionsQuery = SELECT permission FROM permissions WHERE role =
> ?
>
> # User database configuration.
> ds = com.mysql.jdbc.jdbc2.optional.MysqlDataSource
> ds.serverName = localhost
> ds.user = shiro
> ds.password = *[redacted]*
> ds.databaseName = shiro_schema
> userRealm.dataSource = $ds
>
> # Realm configuration.
> securityManager.realms = $userRealm
>
> That much seems straightforward, but notice that the plaintext password for
> the database would appear in the shiro.ini file. I would prefer not to
> store the password there, for obvious reasons including not wanting to check
> a password into version control.
>
> Is there a way to specify that the password should be looked up from a
> separate file or, even better, a keystore? Or is there a better way to
> accomplish the same goal of securing the database password?
>
> Sorry if this ends up being more of a JDBC question that a strictly Shiro
> one, but I was having difficulty finding anything relevant in the
> documentation.
>
> Thanks for any help.
>
>
>
>
> --
> View this message in context: http://shiro-user.582556.n2.nabble.com/How-to-secure-database-password-in-shiro-ini-tp7578763.html
> Sent from the Shiro User mailing list archive at Nabble.com.