Storing sensible configuration data in j2ee-deployment descriptor

Thread view:

E. Ulrich Kriegel - 21 Oct 2005 16:26 GMT

Hi there,
the j2ee-spec defines the env-section of a j2ee deployment descriptor as
a contract between component provider, application assembler and deployer.
Is there any information about pros and cons of storing sensitive data
like ressource passwords as env-entries?

Signature

Thanks in advance
--ukriegel
---------------------------------------------------------------------
Dr. E.Ulrich Kriegel, ulrich.kriegel@isst.fhg.de,
Fraunhofer ISST, Mollstraße 1, D-10178 Berlin, Germany
tel: (++49(0)30) 243 06 446 fax: (++49 (0) 30) 24306 199.
The PKI root certificate of the Fraunhofer Society can be obtained
from http://pki.fraunhofer.de
=====================================================================

Reply to this Message

Ben_ - 21 Oct 2005 17:23 GMT

I find it weird to say the least that a password would be stored there.

Password is a matter of deployment and is subject to change, so why store it
in the archive ?

Reply to this Message

E. Ulrich Kriegel - 24 Oct 2005 05:58 GMT

> I find it weird to say the least that a password would be stored there.
>
> Password is a matter of deployment and is subject to change, so why store it
> in the archive ?

Imagine, that there is a company which develops an j2ee-based
application for another company.
The data center, in which the appliaction will be deployed, will keep
their passwords sectret. So the deployer has to set them in phase 2 of
the j2ee deployment process. If the passwors are stored as env-entries,
there is a definite location where to look for. Otherwise, putting
passwords in other places, e.g. in propertiy files, would mean to parse
all of them to find the corresponding entries.

Signature

Yours
--ukriegel
---------------------------------------------------------------------
Dr. E.Ulrich Kriegel, ulrich.kriegel@isst.fhg.de,
Fraunhofer ISST, Mollstraße 1, D-10178 Berlin, Germany
tel: (++49(0)30) 243 06 446 fax: (++49 (0) 30) 24306 199.
The PKI root certificate of the Fraunhofer Society can be obtained
from http://pki.fraunhofer.de
=====================================================================

Reply to this Message

Ben_ - 24 Oct 2005 06:43 GMT

Don't know for other platforms, but in WebSphere, a DataSource has an
associated J2C Authentication Entry where the admin sets the password to
access the database.

I would find it a pitty that as an Admin I would have to go through
packaging & redeployment only to change a password.

Reply to this Message

Storing sensible configuration data in j2ee-deployment descriptor

Free Magazines