How we can encrypt and decrypt database password in properties file using jasypt in Quarkus. The decryption will be happens while loading or starting the application. Please share your inputs or thoughts on this.
@chrisgleissner any help much be appreciated.
quarkus.datasource.db-kind=postgre quarkus.datasource.username=username quarkus.datasource.password=encrypted pwd(encrypted needs to decrypt while loading application)
You can implement a custom credentials provider. The interface is:
public interface CredentialsProvider {
String USER_PROPERTY_NAME = "user";
String PASSWORD_PROPERTY_NAME = "password";
Map<String, String> getCredentials(String credentialsProviderName);
}
From the documentation:
USER_PROPERTY_NAME and PASSWORD_PROPERTY_NAME are standard properties that should be recognized by any consuming extension that support username/password based authentication. It is required that implementations be valid @ApplicationScoped CDI beans.
Your encrypted password should be available by system properties or env variable for example.
Example:
@ApplicationScoped
@Unremovable
public class MyCredentialsProvider implements CredentialsProvider {
@Override
public Map<String, String> getCredentials(String credentialsProviderName) {
Map<String, String> properties = new HashMap<>();
properties.put(USER_PROPERTY_NAME, "hibernate_orm_test");
properties.put(PASSWORD_PROPERTY_NAME, decryptPassword());
return properties;
}
}
And in the application.properties set the credentials-provider as custom.
quarkus.datasource.credentials-provider=custom
You can check this section in the documentation guides: custom credentials provider
You can create an implementation of io.smallrye.config.ConfigSourceInterceptor. In the getValue method decrypt with Jasypt the property (or properties) you want. Don't forget to register your implementation class as an SPI, META-INF/services/io.smallrye.config.ConfigSourceInterceptor.
More info on https://smallrye.io/docs/smallrye-config/main/index.html