Securely Storing Database Password on JBoss EAP 8

Typically, we store database passwords in plain text on JBoss EAP 8. However, this approach is not considered a best practice due to security concerns. Therefore, it is important to encrypt the password thru several ways of password encryption method. And on this article we’ll try to do encryption using the JBoss EAP’s credential-store.

First we need to create a credential store to be stored in JBoss EAP, with the name of “my_custom_store” and “longpassword” as its password which is located in the JBoss data directory.

$ jboss-cli.sh
You are disconnected at the moment. Type 'connect' to connect to the server or 'help' for the list of supported commands.

[disconnected /] connect

[standalone@localhost:9990 /] /subsystem=elytron/credential-store=my_custom_store:add(path="my_custom_store.jceks", relative-to=jboss.server.data.dir, credential-reference={clear-text=longpassword}, create=true)
{"outcome" => "success"}

Next is storing my database password there,

[standalone@localhost:9990 /]  /subsystem=elytron/credential-store=my_custom_store:add-alias(alias=db_password, secret-value=mysecuredatabasepassword)

And validate it,

[standalone@localhost:9990 /] /subsystem=elytron/credential-store=my_custom_store:read-aliases()
{
    "outcome" => "success",
    "result" => ["db_password"]
}

Next is injecting the value of our secure password from credential store into our database connection. This is happen in our standalone.xml file,

<datasource jndi-name="java:/my-db" pool-name="my-db">
	<connection-url>jdbc:mysql://localhost:3306/test_db</connection-url>
	<driver-class>com.mysql.cj.jdbc.Driver</driver-class>
	<driver>mysql</driver>
	<security>
		<user-name>root</user-name>
		<credential-reference store="my_custom_store" alias="db_password"/>
	</security>
</datasource>

A successful database connection can be tested thru JBoss EAP web console,