Securing database in springboot - java

I have database configuration in application.properties, like the one below:
spring.database.driverClassName=org.postgresql.Driver
spring.datasource.url=jdbc:postgresql://localhost:5432/deebee
spring.datasource.username=postgres
spring.datasource.password=shivendra
Somehow, directly writing the username and password seems to be a security concern to me. Is it ok to have a database configuration like the one I have now?
Also, I haven't done anything for database security in my application, does spring boot provides anything for the securing database?

Related

How to handle configuration When Spring Boot config server itself is down?

I'm new to the spring cloud config server. Consider a scenario where we have 10 spring boot microservice fetching configurations from the Spring Boot Cloud Config. I was wondering How the 10 spring boot microservices will work when the Spring Boot Cloud Config itself is down?
Can someone answer to below queries:
If the config server is down, Will there be downtime for all the microservice connected to it?
Let's say we have a config file application.properties in GitHub and Spring boot config refers to the application.properties file in GitHub What if the username and password to access the application.properties file itself will change?
In terms of Disaster recovery, Do we need any backup of the config server? If yes, How can we achieve the same?
If the config server is down, Will there be downtime for all the microservice connected to it?
In real world application, there will be multiple instances of your config server deployed across multiple availability zones, fronted by load balancer or API gateway, or even you can register your multiple instance with eureka server so that there is No single point of failure.
So how the configuration will look like is instance 1 is in us-east-1
instance 2 in us-west-2, so even if one AZ is down it will not impact your services.
As far as GitHub or external repo is concerned, you can configure config server to read properties natively but that not something I will suggest !!
Let's say we have a config file application.properties in GitHub and Spring boot config refers to the application.properties file in GitHub What if the username and password to access the application.properties file itself will change?
First of all you should not commit password in Github for public repo, secondly password should be dynamically fetched from Idvault, or AWS secret Manager or other services whichever you prefer. So that even if you change password it will not affect any services.
In terms of Disaster recovery, Do we need any backup of the config server? If yes, How can we achieve the same?
Config server is just reading properties/config from repo that you provide,so repository where your code is hosted is of importance to you. Github can take care of that for you !!

H2 console does not show Spring Boot created tables when configuring and using embedded local persistence even though they are there

I have setup H2 as an embedded persistent database ('Embedded (Local) Database' with jdbc:h2:[file:][<path>]<databaseName>) with Spring Boot using Spring Data JPA abstraction, like below
spring.datasource.url=jdbc:h2:file:/home/data/embeddeddb;CACHE_SIZE=${spring.datasource.cache.size:131072}
spring.datasource.driverClassName=org.h2.Driver
spring.datasource.username=someusr
spring.datasource.password=somepwd
spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
spring.jpa.hibernate.ddl-auto=none
spring.h2.console.enabled=true
spring.h2.console.path=/h2-console
#spring.h2.console.settings.trace=false
spring.h2.console.settings.web-allow-others=true
I placed the schema.sql under my project resources and see that i am able to perform CRUD operations via the CrudRepository. I also enabled h2 console via properties as shown above.
But when i connect to the database from the h2 console using the same URL i specified (above), it does not show me the tables i have created or the configured cache size.
This even though i can use #Query methods in my CrudRepository to see that they are there.
I am not sure what i am missing here, can someone throw light on this?
Thanks

Spring Boot MSSQL Kerberos Authentication

Currently in my spring boot application.properties file, I am specifying following lines to connect to MSSql server.
spring.datasource.url=jdbc:sqlserver://localhost;databaseName=springbootd
spring.datasource.username=sa
spring.datasource.password=Projects#123
Instead of giving username and password, I want to authenticate user using kerberos, what all changes I will have to make.
I tried searching in the JPA official documentation but could not find any. Leads here are appreciated.
Basically, you need to set up your krb5.conf file properly. You can verify that configuration via the following command and entering your password:
kinit <user-name>
Additionally, make sure you have a JDBC URL like:
jdbc:sqlserver://servername=server_name;integratedSecurity=true;authenticationScheme=JavaKerberos;userName=user#REALM;password=****
See Microsoft JDBC driver documentation for details.
EDIT:
Forgot to mention the startup arguments. Add the following JVM argument:
-Djava.security.krb5.conf=<PATH_TO>/krb5.conf
I believe this is not neccessary if you use the default krb5.conf but not entirely sure.

Spring Boot not loading username from application.properties

I'm developing a simple web application with spring boot. In the first step, I implemented everything about the page itself and a simple login. Additionally, I implemented a database access using mysql and hibernate. My database runs on a local easyphp devserver.
In the first step, everything worked fine. However, after a reset of the database and recreating the user with the same credentials, Hibernate is not able to get a connection:
2018-02-09 21:17:11.487 ERROR 9592 --- [ restartedMain] o.a.tomcat.jdbc.pool.ConnectionPool : Unable to create initial connections of pool.
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: Access denied for user ''#'localhost' to database 'db'
As I can understand, no username was configured. But in my application.properties, a username is set:
spring.datasource.url=jdbc:mysql://localhost:3306/db?userSSL=false
spring.datasource.username=user
spring.datasource.password=
The exception occurres on startup, so it has to be the configuration. At the database, the user 'user' has all priviliges at the database 'db', but no one on others.
The data source URL might be causing the issue. Is that a typo? Can you check by resetting it to the following? It has to be "useSSL" instead of "userSSL"
spring.datasource.url=jdbc:mysql://localhost:3306/db?useSSL=false
spring.datasource.username=user
spring.datasource.password=
If the above does not work, your problem might be related to permissions for the user. A question posted here relates to yours (although it is in PHP).
Hopefully this resolves it, let us know.
Ok, found the solution by myself. The real username contained a '_' like 'user_name'. Somehow this character was the problem why the username was not read.
Edit: Worked a few times, but the problem still exists...

Spring Boot default H2 jdbc connection (and H2 console)

I am simply trying to see the H2 database content for an embedded H2 database which spring-boot creates when I don't specify anything in my application.properties and start with mvn spring:run. I can see hibernate JPA creating the tables but if I try to access the h2 console at the URL below the database has no tables.
http://localhost:8080/console/
I see suggestions like this one:
View content of embedded H2 database started by Spring
But I don't know where to put the suggested XML in spring-boot and even if I did, I don't want the h2console to be available anymore when an external database is configured so it is more likely that I need to handle this with some kind of conditional code (or maybe just allow spring to automatically handle it in the most ideal case where I only include H2 when a maven profile is activated).
Does anyone have some sample code showing how to get the H2 console working in boot (and also the way to find out what the jdbc connection string that spring is using is)?
This is how I got the H2 console working in spring-boot with H2. I am not sure if this is right but since no one else has offered a solution then I am going to suggest this is the best way to do it.
In my case, I chose a specific name for the database so that I would have something to enter when starting the H2 console (in this case, "AZ"). I think all of these are required though it seems like leaving out the spring.jpa.database-platform does not hurt anything.
In application.properties:
spring.datasource.url=jdbc:h2:mem:AZ;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
spring.datasource.driverClassName=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=
spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
In Application.java (or some configuration):
#Bean
public ServletRegistrationBean h2servletRegistration() {
ServletRegistrationBean registration = new ServletRegistrationBean(new WebServlet());
registration.addUrlMappings("/console/*");
return registration;
}
Then you can access the H2 console at {server}/console/. Enter this as the JDBC URL: jdbc:h2:mem:AZ
As of Spring Boot 1.3.0.M3, the H2 console can be auto-configured.
The prerequisites are:
You are developing a web app
Spring Boot Dev Tools are enabled
H2 is on the classpath
Even if you don't use Spring Boot Dev Tools, you can still auto-configure the console by setting spring.h2.console.enabled to true
Check out this part of the documentation for all the details.
Note that when configuring in this way the console is accessible at: http://localhost:8080/h2-console/
I have found a nice tutorial about this topic:
https://springframework.guru/using-the-h2-database-console-in-spring-boot-with-spring-security/
Basically the correct JDBC URL for me was: jdbc:h2:mem:testdb
From http://docs.spring.io/spring-boot/docs/current/reference/html/common-application-properties.html
H2 Web Console (H2ConsoleProperties):
spring.h2.console.enabled=true //Enable the console.
spring.h2.console.path=/h2-console //Path at which the console will be available.
Adding the above two lines to my application.properties file was enough to access the H2 database web console, using the default username (sa) and password (empty, as in don't enter a password when the ui prompts you).
A similar answer with Step by Step guide.
Add Developer tools dependency to your pom.xml or build.gradle
Maven
<dependencies>
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<optional>true</optional>
</dependency>
</dependencies>
Gradle
dependencies {
compile("org.springframework.boot:spring-boot-devtools")
}
Access the db from http://localhost:8080/h2-console/
Specify jdbc:h2:mem:testdb as JDBC URL
You should see the entity you specified in your project as a table.
For Spring Boot 2.1.1 straight from Spring Initialzr:
Default with devtools is http://127.0.0.1:8080/h2-console/
POM: spring-boot-starter, h2, spring-boot-starter-web, spring-boot-devtools
Without devtools - you need to set it in properties: spring.h2.console.enabled=true spring.h2.console.path=/h2-console
POM: spring-boot-starter, h2, spring-boot-starter-web
Once you get there - set JDBC URL: jdbc:h2:mem:testdb (The default one will not work)
I had only below properties in /resources/application.properties. After running spring boot, using this URL(http://localhost:8080/h2-console/), the table in H2 console was visible and read to view the table data, also you can run simple SQL commands. One thing, in your java code, while fetching data, the column names are upper-case, even though schema.sql is using lower-case names :)
spring.datasource.initialize=true
spring.datasource.url=jdbc:h2:mem:testdb;DB_CLOSE_DELAY=- 1;DB_CLOSE_ON_EXIT=FALSE
spring.datasource.driverClassName=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=
spring.h2.console.enabled=true
Check spring application.properties
spring.datasource.url=jdbc:h2:mem:testdb;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
here testdb is database defined
Make sure h2 console have same value while connecting other wise it will connect to default db
For Spring Boot 2.3.3.RELEASE straight from Spring Initialzr:
POM: data jpa, h2, web
application properties: spring.h2.console.enabled=true
When you run the application look for line like below in the run console:
2020-08-18 21:12:32.664 INFO 63256 --- [ main] o.s.b.a.h2.H2ConsoleAutoConfiguration : H2 console available at '/h2-console'. Database available at 'jdbc:h2:mem:eaa9d6da-aa2e-4ad3-9e5b-2b60eb2fcbc5'
Now use the above JDBC URL for h2-console and click on Connect.
If you use Spring Boot's developer tools, it comes with H2 Console enabled by default. It can be accessed from /h2-console/. On the login interface, for input JDBC URL use value jdbc:h2:mem:testdb. Pay attention to mem string.
If you don't use Spring Boot's developer tools, you can enable the console in application.properties using spring.h2.console.enabled=true. This will enable console under /h2-console. If you want to change the URL then you can add another entry with spring.h2.console.path=my_console_path.
The default schema name is testdb.
More details in Spring Boot Documentation.
In order to get the tables all you need to do is create 2 sql files schema.sql(for table creation) and data.sql(data for the created tables). These files to be put in src/main/resources folder. Spring boot auto detects them and takes care of the rest during runtime.
If your using more than 2 DB in your project ensure to use specific files like (schema-h2.sql -- for h2 DB , schema-oracle.sql -- for oracle DB). The same to be followed for data.sql too.
Also ensure that you drop tables by adding drop table statement in your schema.sql as first statement. To avoid appending of duplicate records.
The link for spring boot is here.
My application.properties is as follows.
spring.datasource.url=jdbc:h2:~/file/Shiva;DB_CLOSE_DELAY=-1;DB_CLOSE_ON_EXIT=FALSE
spring.datasource.driver-class-name=org.h2.Driver
spring.datasource.username=sa
spring.datasource.password=
spring.datasource.platform=h2
spring.jpa.database-platform=org.hibernate.dialect.H2Dialect
spring.h2.console.enabled=true
spring.datasource.initialize=true
spring.error.whitelabel.enabled=true
spring.h2.console.path=/console
spring.datasource.continue-on-error=true
spring.jpa.hibernate.ddl-auto=create
spring.hibernate.hbm2ddl.auto=update
spring.hibernate.show_sql=true
You can follow the steps in the below link.
https://springframework.guru/using-the-h2-database-console-in-spring-boot-with-spring-security/
I found that with spring boot 2.0.2.RELEASE, configuring spring-boot-starter-data-jpa and com.h2database in the POM file is not just enough to have H2 console working. You must configure spring-boot-devtools as below.
Optionally you could follow the instruction from Aaron Zeckoski in this post
<dependency>
<groupId>org.springframework.boot</groupId>
<artifactId>spring-boot-devtools</artifactId>
<optional>true</optional>
</dependency>
Use jdbc:h2:mem:testdb as your path when logging into the H2 console.
Obviously if you have altered Spring Boot properties your datasource may be different, but it seems like you're struggling with how to find the default. That's all there is to it! You'll see your schema after logging in to H2.
I had made a very stupid mistake when I had this same problem. I had added H2 DB for running unit test cases and hence I had set the scope to test in pom.xml. While running the application using mvn spring:run I removed the scope and it works fine now.

Categories

Resources