How to Encrypt and Decrypt using Jasypt in Quarkus for database password

Question

How can we encrypt and decrypt database passwords in properties files using jasypt in Quarkus? The decryption will happen while loading or starting the application. Please share your inputs or thoughts on this.

@chrisgleissner any help would be appreciated.

application.properties

quarkus.datasource.db-kind=postgre
quarkus.datasource.username=username
quarkus.datasource.password=encrypted pwd(encrypted needs to decrypt while loading application)

Answer 1

You can implement a custom credentials provider. The interface is:

public interface CredentialsProvider {

    String USER_PROPERTY_NAME = "user";
    String PASSWORD_PROPERTY_NAME = "password";

    Map<String, String> getCredentials(String credentialsProviderName);

}

From the documentation:

USER_PROPERTY_NAME and PASSWORD_PROPERTY_NAME are standard properties that should be recognized by any consuming extension that support username/password based authentication. It is required that implementations be valid @ApplicationScoped CDI beans.

Your encrypted password should be available by system properties or env variable for example.

Example:

@ApplicationScoped
@Unremovable
public class MyCredentialsProvider implements CredentialsProvider {

    @Override
    public Map<String, String> getCredentials(String credentialsProviderName) {

        Map<String, String> properties = new HashMap<>();
        properties.put(USER_PROPERTY_NAME, "hibernate_orm_test");
        properties.put(PASSWORD_PROPERTY_NAME, decryptPassword());
        return properties;
    }

}

And in the application.properties set the credentials-provider as custom.

quarkus.datasource.credentials-provider=custom

You can check this section in the documentation guides: custom credentials provider

Answer 2

You can create an implementation of io.smallrye.config.ConfigSourceInterceptor. In the getValue method decrypt with Jasypt the property (or properties) you want. Don't forget to register your implementation class as an SPI, META-INF/services/io.smallrye.config.ConfigSourceInterceptor.

More info on https://smallrye.io/docs/smallrye-config/main/index.html