Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
I have Java applications (using Spring running in Jetty Servlet containers) that need to access an Oracle database. What is the best practice for giving the DB credentials to the applications?
I came across Hashicorp Vault's MySQL backend. I like this approach as it keeps the credentials secure and it keeps creating new short-lived ones, so even if one gets compromised it's value is limited. Are there similar approaches for Oracle?
The standard that I've seen is simply use file system permissions - to do so, you need to ensure that the application is running as a dedicated user - that no other application uses that user; that access to that user is restricted similarly; and that the appropriate config files that contain secrets are restricted to just that user - no group or other permissions at all.
Beyond hardware based authentication storage systems, most other schemes simply end up moving the secret that needs to be stored (example, some people suggest encrypting the information - the secret that then needs to be protected becomes the encryption key/initialization vector). Ultimately, SOMETHING needs to grant the access - and there's nothing fundamentally wrong with OS file system permissions.
