Converting bean types in a beans definition file

[davidcnoel]

I am setting up some datasources in my beans definition file. This all works fine. My problem is I do not want the passwords to my databases showing up as clear text in the definition file.

To get around this I thought I could use some existing encryption routines I have to unencrypt the password from the beans definition file. So to do this I made a java bean called Password that has a property called encryptedPassword. The setter method takes a string and uses my existing decryption routines to store the password internally as clear text. I then set up the Password bean in my bean definitions file and I set the property of the password on the datasource to the Password bean. The problem is the datasource expects the password to be of type String and the Password object is of type Password. Since String is final I can't subclass it.

So.... How do I go about doing this? Can I use a PropertyEditor some how? If so are there any examples of how to do this? Better yet is there some best practice that I should be following for setting passwords in configuration files? It seems like I must be missing something trivial.

Thanks

[Colin Sampaleanu]

One option would be for you to use PropertyPlaceholderConfigurer to bring in the pass from an external properties files. Then the password would not be stored in the main config file in CVS, but would rather be written to this separate properties file by whoever is deploying the app.

Alternately, if it is convenient for you to bind objects to JNDI, you could grab it from the JNDI tree with JndiObjectFactoryBean.

As for the PropertyEditor approach, yes, it would work. Using PropertyEditors with Spring is described here:

http://www.springframework.org/docs/...-customeditors
http://www.springframework.org/docs/...alidation.html

Regards,

[irbouho]

You can create a BeanFactory PasswordResolver that implements org.springframework.aop.framework.ProxyFactoryBean and use it as follows:

1.PasswordResolver:

import org.springframework.beans.factory.FactoryBean;

public class PasswordResolver implements FactoryBean
{
	private String cryptedPassword;

	public void setCryptedPassword (String cryptedPassword) { this.cryptedPassword = cryptedPassword; }

	//implement your algorythm here
	public Object getObject () throws Exception {
		return cryptedPassword;
	}

	public Class getObjectType () {
		return String.class;
	}

	public boolean isSingleton () {
		return true;
	}
}

1.applicationContext.xml:

  ...
  <bean id="passwordResolver" class="PasswordResolver">
    <property name="name"><value>Taha Irbouh</value></property>
  </bean>
  ...
    <property name="password">
      <ref local="passwordResolver"/>
    </property>
  ...

HTH

[irbouho]

You can also use a MethodInvokingFactoryBean to call a method on a bean that will decrypt your password.
Setting a bean property as the result of a method invocation

[davidcnoel]

Gee. I guess I need to put my glasses on before reading the docs. I don't know how I missed those sections.

I'm all set now. Thanks guys

[mattinger]

An even more flexible approach is something like the following:

1. Create a general interface for cryption, which can be either
direction

     public interface Cryptor {
        String crypt(String value);
     }

2. Create a resolver for a value, which takes any Cryptor implementation

      public class CryptorResolver implements FactoryBean { 
         private String value; 
         private Cryptor cryptor;

         public void setValue(String value) {
              this.value = value;
         } 
   
         public void setCryptor(Cryptor cryptor) {
              this.cryptor = cryptor;
         }

         public Object getObject () throws Exception { 
              return cryptor.crypt(value); 
         } 

         public Class getObjectType () { 
              return String.class; 
         } 

         public boolean isSingleton () { 
              return false; 
         } 
     }

3. Create encryptor and decryptor implementations

public class EncryptorImpl implements Cryptor { ... }
 
         public class DecryptorImpl implements Cryptor { ... }

4. In your beans.xml, define system wide encryptor and decryptor

<bean id="encryptor" class="EncryptorImpl" isSingleton="true"/>
 
         <bean id="decryptor" class="DecryptorImpl" isSingleton="true" />

5. When you want to decrypt, create an instance of the resolver

<bean id="passwordDecrypter" class="EncryptionResolver"> 
           <property name="cryptor"><ref bean="decryptor" /></property>
           <property name="value"><value>$&#123;epwd&#125;</value></property> 
         </bean>

This approach is much more generic, and allows your application internally to encrypt decrypt items. This is helpful if you store any passwords in the database, such as for external datasources which
are not part of the static configuration, and so forth.