JBoss EAP 7/8 패스워드 암호화 > WAS 자료실

 문서 작성일

원본 작성

 2025/09/08

 1. 문의사항

문의사항

 JBoss EAP 7.4 연동된 DB 패스워드 평문 암호화 가능여부

문의회신

 PiketBox, Elytron을 이용한 패스워드 암호화 (PiketBox는 Deprecated 예정으로 Elytron으로 권장)

 2. 테스트 환경구성

JDK

 JDK 1.8

WAS

 JBoss EAP 7.4.23

데이터베이스

 Oracle 19c

JDBC풀

 OracleDS

JNDI

 java:jboss/OracleDS

URL

 jdbc:oracle:thin:@//192.168.10.219:1521/orclpdb1

User

 orauser1

Password

 orapasswd1

 3. PiketBox 기반

 3.1. picketbox jar 를 이용한 DB 패스워드 암호화

$ java -cp /app/jboss/modules/system/layers/base/org/picketbox/main/picketbox-5.0.3.Final-redhat-00007.jar:/app/jboss/modules/system/layers/base/org/jboss/logging/main/jboss-logging-3.4.1.Final-redhat-00001.jar:$CLASSPATH org.picketbox.datasource.security.SecureIdentityLoginModule orapasswd1

Encoded password: -616c44c7828f18b9b5f3b0caeb302434

 3.2. 데이터소스에 암호화 패스워드 등록

@JBOSS-CLI

/subsystem=security/security-domain=encryptedSecurityDomain:add(cache-type=default)
/subsystem=security/security-domain=encryptedSecurityDomain/authentication=classic:add
/subsystem=security/security-domain=encryptedSecurityDomain/authentication=classic/login-module="encryptedSecurityDomain-Module":add(code="org.picketbox.datasource.security.SecureIdentityLoginModule",flag=required, module-options={"username" => "orauser1", "password" => "-616c44c7828f18b9b5f3b0caeb302434"})

@standalone*.xml

~

                    <authentication>

                            <module-option name="username" value="orauser1"/>

                            <module-option name="password" value="-616c44c7828f18b9b5f3b0caeb302434"/>

                        </login-module>

                    </authentication>

                </security-domain>

~

 3.3. 데이터소스에 암호화 활성화

@standalone*.xml

~

            <datasources>

                    <connection-url>jdbc:oracle:thin:@//192.168.10.219:1521/orclpdb1</connection-url>

                    <driver>oracle</driver>

                    <pool>

                        <min-pool-size>50</min-pool-size>

                        <max-pool-size>50</max-pool-size>

                    </pool>

                    <security>                                                 <!-----

                        <user-name>orauser1</user-name>            제 

                        <password>orapasswd1</password>          거

                    </security>                                                ------>

                    <security>                                                                                  <!------------

                        <security-domain>encryptedSecurityDomain</security-domain>          추가        

                    </security>                                                                                 -------------->

~

 4. Elytron 기반

 4.1. credential-store 생성

# 네이밍 변경 가능

 /subsystem=elytron/credential-store=cs-store:add(create=true,location="/path/ton/ora.keystore",credential-reference={clear-text="OraleDSPasswd"})

 4.2. 자격 증명 저장소에 패스워드 추가

@JBOSS-CLI

 /subsystem=elytron/credential-store=cs-store:add-alias(alias="OraleDSPasswd",secret-value="orapasswd1")

 4.3. 데이터소스의 패스워드 자격증명 참조 설정

@JBOSS-CLI

[standalone@embedded /] batch 
[standalone@embedded / #] /subsystem=datasources/data-source=OracleDS:undefine-attribute(name=password)
[standalone@embedded / #] /subsystem=datasources/data-source=OracleDS:write-attribute(name=credential-reference, value={store=cs-store, alias=ds-password})
[standalone@embedded / #] run-batch

@standalone*.xml

~

                    <connection-url>jdbc:oracle:thin:@//192.168.10.219:1521/orclpdb1</connection-url>

                    <driver>oracle</driver>

                    <pool>

                        <min-pool-size>50</min-pool-size>

                        <max-pool-size>50</max-pool-size>

                    </pool>

                    <security>

                        <user-name>orauser1</user-name>

                        <credential-reference store="cs-store" alias="OracleDSPasswd"/>

                    </security>

~

                    <credential-reference clear-text="OracleDBPasswd"/>

                </credential-store>

~

 5. 적용 여부 확인

 /subsystem=datasources/data-source=OracleDS:write-attribute(name=check-valid-connection-sql)
{
    "outcome" => "success",
    "response-headers" => {
        "operation-requires-reload" => true,
        "process-state" => "reload-required"
    }
}

 참고 문서

solutions 

 URL

3241541

 How to configure credential-store in Elytron subsystem to store secret in JBoss EAP?

7048237

 Store key-store password in Elytron credential-store in JBoss EAP 8 / 7.1+

184963

 Encrypted Passwords in JBoss EAP 6/7.0 Datasources with SecureIdentityLoginModule

55454

 How can I change the encryption algorithm used by the SecureIdentityLoginModule in JBoss?