How can I store sensitive data in Java configuration files?

Question

I have some code that I want to make public. The code sends email via servers, connects to databases, and other tasks requiring usernames/passwords.

I'd like to store the passwords and such in a seperate configuration file so that I don't have to sanitize my code on every commit.

How can I do this? It would be easy to do in C using #define, but I'm not sure how to accomplish this in Java.

EDIT: The environment I'm using is Glassfish

Answer 1

The basic method is put the information in a properties file and use the Properties class to load it at run time. If you're using a J2EE server, database connections are configured in the server and the code references them by an abstract name.

I think I should add that if you're using a server, how to configure it and how to get the connections to your code will vary by server and J2EE level so post your environment. Using the Properties class is pretty obvious just by looking at the javadoc and the load() methods.

Answer 2

In glassfish, go to the admin console and under Resources create a new connection pool. That defines your database connection and will share a pool of those connections among your applications. Now under JDBC Resources, create a new entry that maps that pool to a name. The name is usually something like jdbc/myappname.

For a J2EE5 or later application, you can now add this as a class level variable:

@Resource(mappedName="jdbc/myappname") DataSource myDS;

At runtime the server will inject that resource to your database pool. Then when you need a connection, you can do this inside any method:

Connection conn = myDS.getConnection();

The result is your code doesn't have to care at all about the database connection information or managing a pool of connections. You can deploy the identical code on development and production servers, and they will get an appropriate connection. In order to get the injection, it has to be a class the server creates like an EJB, servlet, tag library handler, or JSF managed bean.