Is there a way to ask for the database password at runtime instead of putting it (encrypted or not) in the hibernate.cfg.xml file?
2
- Ouch! that's an interesting question. Can I ask the context in which you're using Hibernate? Is this a stand-alone application or a web app? Additionally, if it is a web-app, are you using Spring?Dave G– Dave G2010-12-16 13:29:38 +00:00Commented Dec 16, 2010 at 13:29
- At this point it's a stand-alone application, but I want the protection on the database side, not in the application, because the database has better protection than my application. Besides, why should I try to build in an encryption that's already present at the database side? I don't mind wrong people having my application, I only mind wrong people having access to my database.Erik Stens– Erik Stens2010-12-16 13:49:40 +00:00Commented Dec 16, 2010 at 13:49
Add a comment |
3 Answers
Just about every configuration option in Hibernate has a corresponding method on the object being configured. In reality, the configuration is really just a way to bind XML to the objects being set up. See this article for more information: http://docs.jboss.org/hibernate/core/3.3/reference/en/html/session-configuration.html
That said, the onus is on you to collect the password at startup. That can be the most difficult part of the problem. Once you've collected the password, send it to the appropriate property.
Comments
Usually the best way to do it, if you're using a Java EE app server, is to use a JNDI look up to get the database connection instead of using a driver manager. That way the person who sets up the JNDI connection pool is the only one that has to know the password, and it's generally encrypted in the admin console so it's safe.
Comments
I think if you are using programmatic instantiation of the Hibernate configuration, you can initialize it from the configuration file that does not contain a password, set the additional property for the database connection on the configuration object you're instantiating, then call buildConfguration().
