1

Is there an alternative to properties files for managing DB (and other service) connection credentials for a group of web applications? Couldn't you use something similar to a service registry?

For example, the client web app would connect to the "credential registry" server with a key and then retrieve the DB credentials needed. That way, all credentials could be managed/updated/etc. in one place, in the credential registry. It would also be an alternative to having unencrypted passwords in a text file on the web server.

Do people do this in practice? Specifically, is there a more automated way to manage large numbers of credentials in a large number of applications/environments?

2

Yes, there are several tools that provide automating the best practices for managing a database credentials policy.

If you are using AWS then there is AWS Secrets Manager. For a cloud provider agnostic solution there is Hashicorp’s Vault which is manages secrets of all types.

If you want to deploy something locally in your own environment there is Conjur which is open source. There are also other commercial tools like okta and others

0

It depends what threat you want to protect against. If you don't want to have secrets in source / config files, you can store your "master secret" (the one to connect to the "credential registry") in an environment variable.

If, on a multi-tenanted system, one can see system wide environment variables; I'd recommend to have individual secrets per tenant, to access the credential registry. Of course, protected with proper ACL's as well.

An alternative solution is to use certificates based access to fetch credentials. You store the private key protected on your machine (only accessible for the requesting user/process), and a reference to it, such as a thumbprint or so, in a configuration file.

  • Thanks, I am most interested in determining what kinds of solutions people use for the deployment/management of the credentials. Aside from the security issue, managing credentials in config files can be a pain and error-prone. – xdhmoore Apr 20 '18 at 20:52
0

Alternative method would be to use an external authentication server to store the credentials with required security mechanisms (eg: Directory Services Server/LDAP). Database authentication may be handled at this server instead of handling at program as core of authentication could be offloaded to these authentication servers.

Hope you may eliminate your concerns through this way…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.