Encrypting passwords in Tomcat

Apache Tomcat is by far the most popular (open source) web server and Java servlet container. It has been around for a long time and – at the time of writing this post – has reached version 7.0.29. As Apache rightfully claims on its web site, Tomcat powers numerous large-scale, mission-critical web applications across a diverse range of industries and organizations. Therefore, one might imagine that such a widely used server would out-of-the-box already prove to be very secure .

However, alot of weaknesses in Apache Tomcat stem from incorrect or inappropriate configuration – as is the case not only for Tomcat but for the majority of software products, I would imagine. The OWASP organization has written up a nice document with a lot of best practices and recommendations on how to make Tomcat more secure than the default out-of-the-box installation.

The OWASP document rightfully states that best practices advice us never to store clear text passwords, but that in the case of the server.xml it is very difficult to avoid. In this post, I will try to look into ways to avoid storing clear text password in Tomcat’s files that hopefully will make it less difficult to avoid.

Encrypt the admin’s password

Tomcat comes with a nice little app called the Web Application Manager, which makes it easy to deploy a new war-file. To be able to use the application you have to add an account with the role of “manager-gui”. This is done by adding the following two lines to the conftomcat-users.xml file:

<role rolename="manager-gui"/>
<user username="admin" password="admin" roles="manager-gui"/>

1 2	<role rolename="manager-gui"/> <user username="admin" password="admin" roles="manager-gui"/>

As you can clearly see, the password is stored in plain text, which is something we would always like to avoid, especially in a production environment. Also, in real life of course, you would never use admin as the username or password ;).

Fortunately, although it apparently isn’t widely known, Tomcat comes with a script that allows us to encrypt passwords. This script is called digest.bat on Windows or digest.sh on Linux and can be found in the bin directory. With this we can specify the encryption algorithm that we want to use – here we’re using SHA-256 – and we enter the text we want to encrypt:

C:tomcatbin>digest.bat -a sha-256 admin
admin:8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
C:tomcatbin>

C:tomcatbin>digest.bat -a sha-256 admin

admin:8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918

C:tomcatbin>

We can now replace the plain text password in the conftomcat-users.xml file by the AES digest.

But we’re still not quite there yet. We some how have to tell Tomcat that we’ve encrypted the password. So open the file confserver.xml in your editor and locate the following lines of code:

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
       resourceName="UserDatabase" />

1 2	<Realm className="org.apache.catalina.realm.UserDatabaseRealm" resourceName="UserDatabase" />

Add the attribute digest=”sha-256″ so you end up with the following:

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"
       resourceName="UserDatabase"
       digest="sha-256" />

<Realm className="org.apache.catalina.realm.UserDatabaseRealm"

resourceName="UserDatabase"

digest="sha-256" />

Encrypting database passwords

It is well documented how we can configure a JDBC DataSource in Tomcat, and use it in a web application. Within our application we add a resource-ref to our web.xml, like so:

<resource-ref>
    <description>MyDB Connection</description>
    <res-ref-name>jdbc/MyDB</res-ref-name>
    <res-type>javax.sql.DataSource</res-type>
    <res-auth>Container</res-auth>
</resource-ref>

<resource-ref>

<description>MyDB Connection</description>

<res-ref-name>jdbc/MyDB</res-ref-name>

<res-type>javax.sql.DataSource</res-type>

<res-auth>Container</res-auth>

</resource-ref>

Next, we have to download and install the appropriate JDBC driver and copy it to Tomcats lib folder. Then we have to edit the confcontext.xml file and link our resource-ref to a data source by adding the following:

<ResourceLink global="jdbc/MyDB"
              name="jdbc/MyDB"
              type="javax.sql.DataSource"/>

<ResourceLink global="jdbc/MyDB"

name="jdbc/MyDB"

type="javax.sql.DataSource"/>

Finally, edit confserver.xml and add the following lines to the GlobalNamingResources (in this example we’re using Microsoft SQL Server):

<Resource name="jdbc/YourDB"
          auth="Container"
          type="javax.sql.DataSource"
          maxActive="100"
          maxIdle="30"
          maxWait="10000"
          username="databaseUser" password="VeryS3cr3t"
          driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"
          url="jdbc:sqlserver://localhost:1433;databaseName=MyDB"/>

<Resource name="jdbc/YourDB"

auth="Container"

type="javax.sql.DataSource"

maxActive="100"

maxIdle="30"

maxWait="10000"

username="databaseUser" password="VeryS3cr3t"

driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"

url="jdbc:sqlserver://localhost:1433;databaseName=MyDB"/>

That’s it. We’ve configured a DataSource for use in our applications. But, oh dear, as you can clearly see, the database credentials are stored in plain text. And this time we don’t have the aid of a digest.bat script.

Write your own DataSourceFactory

The only thing we can do now, is write our own DataSource that uses encrypted passwords. Of course, we’re not going to write a complete implementation ourselves. Instead, for this example, we are going to rely on the default connection pool that comes with Tomcat, called Tomcat JDBC Connection Pool, and we will create a class that will extend org.apache.tomcat.jdbc.pool.DataSourceFactory.

First of all, create a new Java project and add the tomcat-jdbc library to your classpath. If you’re using maven, simply add the following dependency:

<dependency>
    <groupId>org.apache.tomcat</groupId>
    <artifactId>tomcat-jdbc</artifactId>
    <version>7.0.29</version>
    <scope>provided</scope>
</dependency>

<groupId>org.apache.tomcat</groupId>

<artifactId>tomcat-jdbc</artifactId>

<scope>provided</scope>

</dependency>

Next, we have to write a class called Encryptor that can be used to encrypt and decrypt our passwords. For our example we are going to use the use the AES algorythm. I’m not going to explain the details about AES or encryption since there are already a lot of good articles on the web written by far more capable people than me.

package nl.wimvanhaaren.tomcat.secured;

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.Key;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;
import java.util.Arrays;

import javax.crypto.BadPaddingException;
import javax.crypto.Cipher;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.KeyGenerator;
import javax.crypto.NoSuchPaddingException;
import javax.crypto.spec.SecretKeySpec;

public class Encryptor {

    private static final String ALGORITHM = "AES";

    private static final String defaultSecretKey = "ThisIsAVeryVerySecretKey";

    private Key secretKeySpec;

    public Encryptor() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException,
            UnsupportedEncodingException {
        this(null);
    }

    public Encryptor(String secretKey) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,
            UnsupportedEncodingException {
        this.secretKeySpec = generateKey(secretKey);
    }

    public String encrypt(String plainText) throws InvalidKeyException, NoSuchAlgorithmException,
            NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);
        byte[] encrypted = cipher.doFinal(plainText.getBytes("UTF-8"));
        return asHexString(encrypted);
    }

    public String decrypt(String encryptedString) throws InvalidKeyException, IllegalBlockSizeException,
            BadPaddingException, NoSuchAlgorithmException, NoSuchPaddingException {
        Cipher cipher = Cipher.getInstance(ALGORITHM);
        cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
        byte[] original = cipher.doFinal(toByteArray(encryptedString));
        return new String(original);
    }

    private Key generateKey(String secretKey) throws UnsupportedEncodingException, NoSuchAlgorithmException {
        if (secretKey == null) {
            secretKey = defaultSecretKey;
        }
        byte[] key = (secretKey).getBytes("UTF-8");
        MessageDigest sha = MessageDigest.getInstance("SHA-1");
        key = sha.digest(key);
        key = Arrays.copyOf(key, 16); // use only the first 128 bit

        KeyGenerator kgen = KeyGenerator.getInstance("AES");
        kgen.init(128); // 192 and 256 bits may not be available

        return new SecretKeySpec(key, ALGORITHM);
    }

    private final String asHexString(byte buf[]) {
        StringBuffer strbuf = new StringBuffer(buf.length * 2);
        int i;
        for (i = 0; i < buf.length; i++) {
            if (((int) buf[i] &amp; 0xff) < 0x10) {
                strbuf.append("0");
            }
            strbuf.append(Long.toString((int) buf[i] &amp; 0xff, 16));
        }
        return strbuf.toString();
    }

    private final byte[] toByteArray(String hexString) {
        int arrLength = hexString.length() >> 1;
        byte buf[] = new byte[arrLength];
        for (int ii = 0; ii < arrLength; ii++) {
            int index = ii << 1;
            String l_digit = hexString.substring(index, index + 2);
            buf[ii] = (byte) Integer.parseInt(l_digit, 16);
        }
        return buf;
    }

    public static void main(String[] args) throws Exception {
        if (args.length == 1 || args.length == 2) {
            String plainText = args[0];
            String secretKey = args.length == 2 ? args[1] : null;
            Encryptor aes = null;
            if (secretKey == null) {
                aes = new Encryptor();
            } else {
                aes = new Encryptor(secretKey);
            }
            String encryptedString = aes.encrypt(plainText);
            System.out.println(plainText + ":" + encryptedString);
        } else {
            System.out.println("USAGE: java AES string-to-encrypt [secretKey]");
        }
    }

}

100

101

102

103

104

105

106

package nl.wimvanhaaren.tomcat.secured;

import java.io.UnsupportedEncodingException;

import java.security.InvalidKeyException;

import java.security.Key;

import java.security.MessageDigest;

import java.security.NoSuchAlgorithmException;

import java.util.Arrays;

import javax.crypto.BadPaddingException;

import javax.crypto.Cipher;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.KeyGenerator;

import javax.crypto.NoSuchPaddingException;

import javax.crypto.spec.SecretKeySpec;

public class Encryptor {

private static final String ALGORITHM = "AES";

private static final String defaultSecretKey = "ThisIsAVeryVerySecretKey";

private Key secretKeySpec;

public Encryptor() throws InvalidKeyException, NoSuchAlgorithmException, NoSuchPaddingException,

UnsupportedEncodingException {

this(null);

}

public Encryptor(String secretKey) throws NoSuchAlgorithmException, NoSuchPaddingException, InvalidKeyException,

UnsupportedEncodingException {

this.secretKeySpec = generateKey(secretKey);

}

public String encrypt(String plainText) throws InvalidKeyException, NoSuchAlgorithmException,

NoSuchPaddingException, IllegalBlockSizeException, BadPaddingException, UnsupportedEncodingException {

Cipher cipher = Cipher.getInstance(ALGORITHM);

cipher.init(Cipher.ENCRYPT_MODE, secretKeySpec);

byte[] encrypted = cipher.doFinal(plainText.getBytes("UTF-8"));

return asHexString(encrypted);

}

public String decrypt(String encryptedString) throws InvalidKeyException, IllegalBlockSizeException,

BadPaddingException, NoSuchAlgorithmException, NoSuchPaddingException {

Cipher cipher = Cipher.getInstance(ALGORITHM);

cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);

byte[] original = cipher.doFinal(toByteArray(encryptedString));

return new String(original);

}

private Key generateKey(String secretKey) throws UnsupportedEncodingException, NoSuchAlgorithmException {

if (secretKey == null) {

secretKey = defaultSecretKey;

}

byte[] key = (secretKey).getBytes("UTF-8");

MessageDigest sha = MessageDigest.getInstance("SHA-1");

key = sha.digest(key);

key = Arrays.copyOf(key, 16); // use only the first 128 bit

KeyGenerator kgen = KeyGenerator.getInstance("AES");

kgen.init(128); // 192 and 256 bits may not be available

return new SecretKeySpec(key, ALGORITHM);

}

private final String asHexString(byte buf[]) {

StringBuffer strbuf = new StringBuffer(buf.length * 2);

int i;

for (i = 0; i < buf.length; i++) {

if (((int) buf[i] & 0xff) < 0x10) {

strbuf.append("0");

}

strbuf.append(Long.toString((int) buf[i] & 0xff, 16));

}

return strbuf.toString();

}

private final byte[] toByteArray(String hexString) {

int arrLength = hexString.length() >> 1;

byte buf[] = new byte[arrLength];

for (int ii = 0; ii < arrLength; ii++) {

int index = ii << 1;

String l_digit = hexString.substring(index, index + 2);

buf[ii] = (byte) Integer.parseInt(l_digit, 16);

}

return buf;

}

public static void main(String[] args) throws Exception {

if (args.length == 1 || args.length == 2) {

String plainText = args[0];

String secretKey = args.length == 2 ? args[1] : null;

Encryptor aes = null;

if (secretKey == null) {

aes = new Encryptor();

} else {

aes = new Encryptor(secretKey);

}

String encryptedString = aes.encrypt(plainText);

System.out.println(plainText + ":" + encryptedString);

} else {

System.out.println("USAGE: java AES string-to-encrypt [secretKey]");

}

So what we have here is nothing more than some code that can encrypt and decrypt text using the AES algorythm. What is important to note is that I’ve added a main method which will enable us later on to encrypt our password from the commandline in order to copy and paste it into our Tomcat configuration file.

Now what we’re actually most interested in, is the following class that we are going to write. So add a new class called EncryptedDataSourceFactory and have it extend org.apache.tomcat.jdbc.pool.DataSourceFactory:

package nl.wimvanhaaren.tomcat.secured;

import java.io.UnsupportedEncodingException;
import java.security.InvalidKeyException;
import java.security.NoSuchAlgorithmException;
import java.sql.SQLException;
import java.util.Properties;

import javax.crypto.BadPaddingException;
import javax.crypto.IllegalBlockSizeException;
import javax.crypto.NoSuchPaddingException;
import javax.naming.Context;
import javax.sql.DataSource;

import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;
import org.apache.tomcat.jdbc.pool.DataSourceFactory;
import org.apache.tomcat.jdbc.pool.PoolConfiguration;
import org.apache.tomcat.jdbc.pool.XADataSource;

public class EncryptedDataSourceFactory extends DataSourceFactory {

    private static final Log log = LogFactory.getLog(EncryptedDataSourceFactory.class);

    private Encryptor encryptor = null;

    public EncryptedDataSourceFactory() {
        try {
            encryptor = new Encryptor(); // If you've used your own secret key, pass it in...
        } catch (InvalidKeyException | NoSuchAlgorithmException | NoSuchPaddingException | UnsupportedEncodingException e) {
            log.fatal("Error instantiating decryption class.", e);
            throw new RuntimeException(e);
        }
    }

    @Override
    public DataSource createDataSource(Properties properties, Context context, boolean XA) throws InvalidKeyException,
            IllegalBlockSizeException, BadPaddingException, SQLException, NoSuchAlgorithmException,
            NoSuchPaddingException {
        // Here we decrypt our password.
        PoolConfiguration poolProperties = EncryptedDataSourceFactory.parsePoolProperties(properties);
        poolProperties.setPassword(encryptor.decrypt(poolProperties.getPassword()));

        // The rest of the code is copied from Tomcat's DataSourceFactory.
        if (poolProperties.getDataSourceJNDI() != null && poolProperties.getDataSource() == null) {
            performJNDILookup(context, poolProperties);
        }
        org.apache.tomcat.jdbc.pool.DataSource dataSource = XA ? new XADataSource(poolProperties)
                : new org.apache.tomcat.jdbc.pool.DataSource(poolProperties);
        dataSource.createPool();

        return dataSource;
    }

}

package nl.wimvanhaaren.tomcat.secured;

import java.io.UnsupportedEncodingException;

import java.security.InvalidKeyException;

import java.security.NoSuchAlgorithmException;

import java.sql.SQLException;

import java.util.Properties;

import javax.crypto.BadPaddingException;

import javax.crypto.IllegalBlockSizeException;

import javax.crypto.NoSuchPaddingException;

import javax.naming.Context;

import javax.sql.DataSource;

import org.apache.juli.logging.Log;

import org.apache.juli.logging.LogFactory;

import org.apache.tomcat.jdbc.pool.DataSourceFactory;

import org.apache.tomcat.jdbc.pool.PoolConfiguration;

import org.apache.tomcat.jdbc.pool.XADataSource;

public class EncryptedDataSourceFactory extends DataSourceFactory {

private static final Log log = LogFactory.getLog(EncryptedDataSourceFactory.class);

private Encryptor encryptor = null;

public EncryptedDataSourceFactory() {

try {

encryptor = new Encryptor(); // If you've used your own secret key, pass it in...

} catch (InvalidKeyException | NoSuchAlgorithmException | NoSuchPaddingException | UnsupportedEncodingException e) {

log.fatal("Error instantiating decryption class.", e);

throw new RuntimeException(e);

}

@Override

public DataSource createDataSource(Properties properties, Context context, boolean XA) throws InvalidKeyException,

IllegalBlockSizeException, BadPaddingException, SQLException, NoSuchAlgorithmException,

NoSuchPaddingException {

// Here we decrypt our password.

PoolConfiguration poolProperties = EncryptedDataSourceFactory.parsePoolProperties(properties);

poolProperties.setPassword(encryptor.decrypt(poolProperties.getPassword()));

// The rest of the code is copied from Tomcat's DataSourceFactory.

if (poolProperties.getDataSourceJNDI() != null && poolProperties.getDataSource() == null) {

performJNDILookup(context, poolProperties);

}

org.apache.tomcat.jdbc.pool.DataSource dataSource = XA ? new XADataSource(poolProperties)

: new org.apache.tomcat.jdbc.pool.DataSource(poolProperties);

dataSource.createPool();

return dataSource;

}

Basically, the only thing that EncryptedDataSourceFactory does, is decrypt the database password. All the heavy lifting is left to org.apache.tomcat.jdbc.pool.DataSourceFactory.

The project is finished. So, export your project into an executable JAR file, e.g. encryptedDS.jar, and copy it to the Tomcat lib directory.

Encrypt your database password by executing the following:

C:tomcatlib>java -jar encryptedDS.jar s3cr3t
s3cr3t:dd30b6e87a972be1999fda04f657eca0
C:tomcatlib>

C:tomcatlib>java -jar encryptedDS.jar s3cr3t

s3cr3t:dd30b6e87a972be1999fda04f657eca0

C:tomcatlib>

Replace the password in server.xml with the encrypted one. And, finally we have to tell Tomcat to use our custom DataSource factory. To do so, add an attribute factory, specifying our fully qualified class, to the Resource element. So what we’ve should end up with in server.xml is the following:

<Resource name="jdbc/MyDB"
          factory="nl.wimvanhaaren.tomcat.secured.EncryptedDataSourceFactory"
          auth="Container"
          type="javax.sql.DataSource"
          maxActive="100"
          maxIdle="30"
          maxWait="10000"
          username="databaseUser"
          password="dd30b6e87a972be1999fda04f657eca0"
          driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"
          url="jdbc:sqlserver://localhost:1433;databaseName=MyDB"/>

<Resource name="jdbc/MyDB"

factory="nl.wimvanhaaren.tomcat.secured.EncryptedDataSourceFactory"

auth="Container"

type="javax.sql.DataSource"

maxActive="100"

maxIdle="30"

maxWait="10000"

username="databaseUser"

password="dd30b6e87a972be1999fda04f657eca0"

driverClassName="com.microsoft.sqlserver.jdbc.SQLServerDriver"

url="jdbc:sqlserver://localhost:1433;databaseName=MyDB"/>

So at last, with a little bit of effort, we’ve managed to encrypt our database password. And if you want to, you could even go one step further and also encrypt the other attributes
such as the username or url by adding a few more lines of code to the EncryptedDataSourceFactory.createDataSource() method.

49 Replies to “Encrypting passwords in Tomcat”

Sam says:

04-10-2018 at 17:49

I am trying to use the encryption key from an property in context.xml in the Tomcat conf folder.

The DataSourceFactory I implemented does not seem to have access to look up the values in the comp/env JNDI tree. I am not quite certain if the JNDI has not been loaded by the time the DataSourceFactory is instantiated or it’s using the wrong ClassLoader or …

It’s odd because I can write JAX-RS endpoints that can look up values in the comp/env JNDI tree with no problems.
Kanth says:

28-08-2018 at 18:00

Does this works against java 8? our tomcat environment is on java 8.

Thanks,
Kanth
Walid DJAMA says:

27-03-2018 at 14:29

Hi,
If there is a connection break, validation query does not restore the connection without restarting.
Any help, please ?
Regards
Dharmendra Sharma says:

03-01-2018 at 19:20

I was thinking its still not secure as any one who knows can use the following, And should able to get the password.

Cipher cipher = Cipher.getInstance(ALGORITHM);
cipher.init(Cipher.DECRYPT_MODE, secretKeySpec);
byte[] original = cipher.doFinal(toByteArray(encryptedString));
return new String(original);

Any one please help me what I understood is right or wrong. If I am right then what could be other approach to secure fully.
salonee says:

21-09-2017 at 19:35

Hi i have used this implementation for Tomcat 7 but am facing the issue with my datasource connection: “Unexpected exception resolving reference
java.sql.SQLException: oracle.jdbc.xa.client.OracleXADataSource cannot be cast to java.sql.Driver”

Eg:

Is this issue related to the creatDatasource method which takes XA as a parameter
Pingback: 【技术分享】通过JMX访问破坏Apache Tomcat - 莹莹之色
Pingback: 通过JMX访问破坏Apache Tomcat | 安全脉搏
Pingback: Apache Tomcat: Verschlüsseln von Passwörtern - Technik Blog
Juergen Wuest says:

07-11-2016 at 17:31

Nifty solution that works well – thank you! I have two suggestions for the implementation:

1) Method Encryptor.generateKey() instantiates and inits a KeyGenerator (variable kgen), but doesn’t do anything with it. These two lines can be dropped.

2) Method EncryptedDataSourceFactory.createDataSource() could be simplified as follows:

@Override
public DataSource createDataSource(Properties properties, Context context, boolean XA) throws Exception {
String encryptedPassword=properties.getProperty(PROP_PASSWORD);
properties.put(PROP_PASSWORD, encryptor.decrypt(encryptedPassword));
return super.createDataSource(properties, context, XA);
}

This avoids copying code from the base class and should be more robust against changes in future versions of Tomcat.
Madhav says:

06-11-2016 at 06:25

Wonderful and very useful article. Thanks
Senthil says:

15-09-2016 at 06:47

Will it work in tomcat 6?
Amrita says:

30-08-2016 at 01:08

Please help with the issue .. Is there a possibility of connection leak in the code?
Pingback: Encrypt Apache-Tomcat database connection | Yathrika
Amrita says:

26-08-2016 at 10:22

I am getting a pool exhausted exception..
Timeout: Pool empty. Unable to fetch a connection in 10 seconds, none available[size:8; busy:8; idle:0; lastwait:10000].
Terry says:

14-07-2016 at 19:01

org.apache.tomcat.jdbc.pool.DataSourceFactory parsePoolProperties
WARNING: poolPreparedStatements is not a valid setting, it will have no effect.

Anyone know why I would get this error while using the “poolPreparedStatements” and “maxOpenPreparedStatements” options?
Gracie says:

15-04-2016 at 02:18

I’m using this in java 1.8 and tomcat 7. It works after I restart tomcat. However, I got exception everytime the next day. Any clue? Many thanks!

org.springframework.security.authentication.AuthenticationServiceException: Could not open JPA EntityManager for transaction; nested exception is javax.persistence.PersistenceException: org.hibernate.TransactionException: JDBC begin transaction failed:
at org.springframework.security.authentication.dao.DaoAuthenticationProvider.retrieveUser(DaoAuthenticationProvider.java:109)
Chris says:

26-10-2015 at 17:47

Shoubhik and Rober2D2 have asked the proper questions: now how to protect the password used to do the password-encryption? This article just adds code and moves the problem somewhere else. There is *no additional security for database connections* demonstrated in this post, only hiding the problem to pass a (naive) security audit.
Chris says:

22-10-2015 at 16:10

Many thanks. This is beautifully simple. It had bothered me for a while that the passwords were in clear text.
Terry H says:

14-10-2015 at 17:41

Eclipse is complaining about &amp. “amp cannot be resolved to a variable”. Also “Syntax error on token “;”, * expected”. Lines 70 and 73 I’m on eclipse 4.4.2. Any ideas?
1. Jonghong Kim says:
  
  24-08-2017 at 13:58
  
  Just replace & with &
  
  🙂
2. new_user says:
  
  31-05-2018 at 10:28
  
  In HTML, you cannot simply write &, because that is an escape character. So, in history, they invented the escape sequence for ampersands, which is: &. That is what the website is showing you unfortunately.
  
  Solution: Just replace “&” with “&” (without double quotes)
  Actual : if (((int) buf[i] & 0xff) < 0x10) {
  Solution : if (((int) buf[i] & 0xff) < 0x10) {
  1. new_user says:
    
    31-05-2018 at 10:30
    
    Solution: Just replace “&amp” with “&” (without double quotes)
    
    Actual : if (((int) buf[i] & 0xff) < 0x10) {
    Solution : if (((int) buf[i] & 0xff) < 0x10) {
Robert Wells says:

09-10-2015 at 18:28

I am using this code in java 1.8. The encrypted password is being returned with dashes. When I try to decrypt the parseInt call is blowing up. I know paresInt cannot hadle dashes. I suspect that the encryption should not be returning a string with dashes. I used sha-1 utility to encrypt the password and I get a different result.
varsha says:

04-09-2015 at 13:52

Hello Everyone,

I am facing a issue while doing migration of Apache tomcat server from 5.5 to 7.0.61. Following error is coming while starting my application which refer tomcat 7 lib file at runtime.
Logs :
FATAL [localhost-startStop-1 ] (asourceConnectionProvider.java:55) – Could not find datasource: java:comp/env/jdbc/mobiliser/core
javax.naming.NamingException: Could not load resource factory class [Root exception is java.lang.ClassNotFoundException: SecureDataSourceFactory]

I am not able to find jar which includes SecureDataSourceFactory class. Please help me to resolve this error. All valuable inputs I required from everyone.

Thanks in Advance 🙂
Yuwi says:

31-08-2015 at 10:03

Plz help me

G:\tomcat7\bin>digest.bat -a sha-256 admin
Exception in thread “main” java.lang.UnsupportedClassVersionError: Bad version n
umber in .class file
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClass(ClassLoader.java:620)
at java.security.SecureClassLoader.defineClass(SecureClassLoader.java:12
4)
at java.net.URLClassLoader.defineClass(URLClassLoader.java:260)
at java.net.URLClassLoader.access$100(URLClassLoader.java:56)
at java.net.URLClassLoader$1.run(URLClassLoader.java:195)
at java.security.AccessController.doPrivileged(Native Method)
at java.net.URLClassLoader.findClass(URLClassLoader.java:188)
at java.lang.ClassLoader.loadClass(ClassLoader.java:306)
at sun.misc.Launcher$AppClassLoader.loadClass(Launcher.java:268)
at java.lang.ClassLoader.loadClass(ClassLoader.java:251)
at java.lang.ClassLoader.loadClassInternal(ClassLoader.java:319)
1. Wim says:
  
  31-08-2015 at 11:56
  
  Most likely, you’ve compiled your classes with a Java version that is newer than the version you’re using for execution.
Vignesh Balasubramoniam says:

17-07-2015 at 11:20

Hi Wim,
Thanks for the article. Helps understand a key feature of tomcat. Just had one query if in a windows environment we have Tomcat 7.0 installed and the files digest.bat and digest.sh are missing, what can be done to implement above method to hash the passwords in tomcat-users.xml. i.e can we copy these files from another tomcat 7 bin foler, is any version match required. And in above scenario consider that these files are not present in Prod or Non-Prod environment. Thanks in advance.

Regards,
Vignesh
srini says:

01-04-2015 at 16:12

Number format exception at given line

Integer.parseInt(l_digit, 16);

Please help me on this
Rober2D2 says:

31-03-2015 at 11:03

I’ve been looking for something like this for a while. Now I can encrypt DB password, but this only solves part of the problem.

If an attacker gains access to context.xml, it will probably gain access to the code (or at lesat the .class files). I think that the only solution that will work is that the secret key is provided on startup by a user.
SA says:

22-09-2014 at 02:13

Thanks for this great article. In the pool implementation, wouldn’t it be an option to just update the password from encrypted to decrypted, and pass on the heavy-lifting entirely to super class.
String passwordEncrypted = properties.getProperty(“password”);
String decrypted = encryptor.decrypt(passwordEncrypted);
properties.setProperty(“password”, decrypted);
DataSource d = super.createDataSource(properties, context, XA);
log.info(“EncryptedDBConnectionFactory datasource created”);
1. Pik says:
  
  24-03-2016 at 00:47
  
  I think this of Rober2D2 is an important point: password is just obfuscated if the encryption key is accessible somehow and inside a class it is accessible. The option of a pin or a key inserted at startup is more secure and works good for desktop apps with a human user, however servers restart by themselves, is impossible to be there each time.
@mol says:

29-04-2014 at 10:30

Very useful article. Thaks Wim. I am able to encrypt my password but how to use this encrypted password for doing a database connection? Thanks in advance.
krish says:

15-01-2014 at 04:53

Thank you Wim
krish says:

14-01-2014 at 07:23

one last question that what changes are required to compile this on JDK 1.6. Because in my environment tomcat is pointing to jdk 1.6, so I might get java version incompatible exception…
thank you,
1. Wim van Haaren says:
  
  14-01-2014 at 07:57
  
  Since you’ve already replaced the multi-catch, everything else should work fine with Java 1.6. Just make sure that the code is compiled with a JDK 1.6 compiler.
krish says:

14-01-2014 at 03:42

Thanks a lot Wim, it is working now……
krish says:

13-01-2014 at 08:52

Hi Wim,
Thank you for the response. I have used 1.7, and able compile class, built jar. Generated encrypted key, and update data source config with encrypted key, and added factory name as you suggested in the article,
factory=”nl.amc.adict.tomcat7.AESEncryptedDataSourceFactory”
But I got below exception in my logs, seems I migght be giving a wrong fully qualified class name ? (I used same naming convention as it is in above)
FINE: loadClass(java.io.PrintStream, false)
DBConnectionManager::constructor [Mon Jan 13 03:38:25 EST 2014] Exception while retrieving a DataSource object
javax.naming.NamingException: Could not load resource factory class [Root exception is java.lang.ClassNotFoundException: nl.amc.adict.tomcat7.AESEncryptedDataSourceFactory]
at org.apache.naming.factory.ResourceFactory.getObjectInstance(ResourceFactory.java:84)
at javax.naming.spi.NamingManager.getObjectInstance(NamingManager.java:321)
at org.apache.naming.NamingContext.lookup(NamingContext.java:843)
at org.apache.naming.NamingContext.lookup(NamingContext.java:154)

Thanks,
Kris
1. Wim van Haaren says:
  
  13-01-2014 at 09:27
  
  Hi Kris,
  
  Seems you’ve found a typo in my blog (which I’ve now corrected). Seems I’ve used the wrong package and classname in the server.xml sampe. So, try replacing the line
  
  factory=”nl.amc.adict.tomcat7.AESEncryptedDataSourceFactory”
  
  inside the server.xml file by the following
  
  factory=”nl.wimvanhaaren.tomcat.secured.EncryptedDataSourceFactory”
  
  I hope this fixes your ClassNotFoundException.
  
  Regard,
  Wim
krish says:

12-01-2014 at 02:05

hi Wim van Haaren,

I created jar with these two classes, and able to create encrypted passwd. But in run time getting naming not found exception, basically due to class not found exception of new factory created (testing on Tomcat 7.0.42).

Seems multi exception catch is not supported on jdk 1.6…, so I changed it in my code.
can you pls help me here, am I missing anything here..appreciate it

Thx,
Kris
1. Wim van Haaren says:
  
  12-01-2014 at 10:33
  
  Hi Kris,
  
  For multi-catch to work you indeed have to use Java 7.
  Reagarding the class not found exeception, if you’ve put your jar-file inside Tomcat’s lib folder, Tomcat should be able to resolve your classes.
  
  Regards,
  Wim
Kunal says:

13-12-2013 at 12:18

What about key store password encryption. If you have any approach, please provide the same.
e.g.
Shoubhik Bose says:

26-10-2013 at 16:25

Where are you saving the encryption key ?
Are they also on the server?
1. Wim van Haaren says:
  
  27-10-2013 at 08:44
  
  Everything happens inside the Encryptor class – using the AES algorithm. For this basic example I didn’t use external encryption keys nor a salt.
  If you want to you could extend the example so that it uses a salt and then you can chose yourself where to store it. This would be even more secure but you would have to ask yourself if it would be worth the extra effort (i.e., do you trust your ops guy? 😉 )
RIZKA ARIFIANTO says:

20-09-2013 at 06:28

This is what I have been looking for. Great. Thanks a lot.
Junny says:

18-07-2013 at 07:50

Super, goede blog! Hoe lang blog je al? je schrijft leuk.
Het geheel van je site ziet er ook gelikt uit en ook je content in interessant!
Pingback: Setting up and using Apache tomcat connection pool with Oracle | Technology Sage
Alejandrina says:

04-06-2013 at 12:12

I quite like reading a post that will make people think.
Also, many thanks for allowing me to comment!
bee says:

14-05-2013 at 04:35

Hi,

I tried your example with my web application in tomcat. After i add factory attribute to Resource in server.xml. It becomes not working and showed me Exception with could not find datasource. I did copy the jar file to tomcatlib.
Do i miss out any step? Thank you
1. sravan says:
  
  21-09-2016 at 17:53
  
  i am facing the same issue , datasource missing and all , i used JNDI in my application .
  
  actually :
  i have a running spring application on tomcat, database configuration in tomcat > context.xml , now i created two classes -> encyptor and factory , now added factory attributr in context.xml but it is showing data source not found.
  
  when i start the tomcat :
  
  WARNING: Failed to register in JMX: javax.naming.NamingException: Could not load resource factory class [Root exception is java.lang.ClassNotFoundException: com.wellsfargo.omni.encryption.EncryptedDataSourceFactory]
  
  when i hit the database : i mean try to retrieve data from database :following error:
  org.springframework.beans.factory.BeanCreationException: Error creating bean with name ‘oracledataSource’: Invocation of init method failed; nested exception is javax.naming.NameNotFoundException: Name [jdbc/ABCdatabase] is not bound in this Context. Unable to find [jdbc].

Comments are closed.