@mikexliu that way it’ll work. Placeholders
${NAME:default} are resolved at the Environment level
@mikexliu basically all you need is to add that, no other Annotations like @EnableEncryptableProperties, @EncryptablePropertySource and no starter jar. That should be enough.
@ulisesbocchio
hey, sorry for kinda late reply. I tried to use EncryptableEnvironment, and it seemed like the original case worked, but now there's another problem:
user: user
password: ${PASSWORD:ENC(asdf)}
endpoint: https://${user}:${password}@localhost:30000Trying to resolve turns into:
user: user
password: ENC(asdf)
endpoint: https://user:ENC(asdf)@localhost:30000This makes sense since resolve happens before decrypt. But seems like this is a bug because the EncryptableEnvironment, when it follows the ${...} resolution, it should also be trying to decrypt if it can. Thoughts?
that line should probably be:
propVal = placeholderResolver.resolvePlaceholder(propVal);
but I understand why it's done the way it is right now, to reuse potential already resolved placeholders
for now you should probably stick to:
user: user
defaultPassword: ENC(asdf)
password: ${PASSWORD:${defaultPassword}}
endpoint: https://${user}:${password}@localhost:30000which adds one more level of indirection but the works because defaultPassword is a top level property
But just like David Wheeler said... All problems in computer science can be solved by another level of indirection
@naderi_armin_twitter it should be the same with gradle, props should be decrypted at runtime in the app. What are you trying to do with gradle properties?
@ulisesbocchio I am extracting passwords for binary repositories to separate property files. The problem is that Gradle does not run at the application's runtime, but rather within its own JVM during the building of the application. I need to run jasypt within Gradle's JVM.
@naderi_armin_twitter is it possible that you upload a sample project to github for me to take a look? I can't picture what you're saying. The library is meant to be used with password decryption at runtime, so unless you're trying to decrypt a property as part of your build process, I'm not sure what else could it be. In any case, regardless of where it runs, passing property
-Djasypt.encryptor.password=password should be enough in any JVM. Keep in mind though that spring boot has to run.
oh I think I found it - https://mvnrepository.com/artifact/com.github.ulisesbocchio/jasypt-spring-boot-starter/1.4-java7
actually doesn't look like they've released 1.9.3 yet
yeah, last version was 1.9.2
I don't think they'll be releasing a new version any time soon
hey @ulisesbocchio, first of all -- thanks for the work put into the package so far -- is there any way to look for encryptable properties recursively in the resources directory? currently it's only picking up application.properties. I've got some other .properties files stored in directories under the resources dir..
@EncryptablePropertySources({@EncryptablePropertySource("classpath:encrypted.properties"),
@EncryptablePropertySource("classpath:encrypted2.properties")})
@EncryptablePropertySource("classpath:encrypted2.properties")})
chance*
I'd like the app to be able to look inside the resources directory and all subdirectories for .properties files
without needing to specify individual property files as they might be different depending on the deployment
it doesn't really look for any files
it uses whatever is loaded by Spring by default and any other property sources you may have loaded
you could do something like this @BBK-PiJ-2016-11 :
@Bean
public PropertySource allPropertiesSource() throws Exception {
PathMatchingResourcePatternResolver resolver = new PathMatchingResourcePatternResolver();
Resource[] resources = resolver.getResources("classpath*:*.properties");
PropertySourceLoader loader = new PropertiesPropertySourceLoader();
Function<Resource, PropertySource> toSource = resource -> {
try {
return loader.load(resource.getFilename(), resource).get(0);
} catch (Exception e) {
throw new RuntimeException(e);
}
};
Function<List<PropertySource>, PropertySource> collector = sources -> {
CompositePropertySource ps = new CompositePropertySource("all properties");
sources.forEach(ps::addPropertySource);
return ps;
};
return Arrays.stream(resources).map(toSource).collect(Collectors.collectingAndThen(Collectors.toList(), collector));
}
import org.jasypt.encryption.pbe.PooledPBEStringEncryptor;
import org.jasypt.encryption.pbe.config.SimpleStringPBEConfig;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import com.ulisesbocchio.jasyptspringboot.EncryptablePropertyDetector;
import com.ulisesbocchio.jasyptspringboot.EncryptablePropertyResolver;
import com.ulisesbocchio.jasyptspringboot.annotation.EncryptablePropertySource;
import com.ulisesbocchio.jasyptspringboot.annotation.EncryptablePropertySources;
/**
- @author Ravat
/
@Configuration
@EncryptablePropertySources({ @EncryptablePropertySource("classpath:platform-encrypted.properties") })
public class PlatformEncryptionConfiguration {
@Bean(name = "encryptablePropertyDetector")
public EncryptablePropertyDetector encryptablePropertyDetector() {
return new MyEncryptablePropertyDetector();
}
@Bean(name="encryptablePropertyResolver")
EncryptablePropertyResolver encryptablePropertyResolver() {
return new MyEncryptablePropertyResolver();
}
private class MyEncryptablePropertyDetector implements EncryptablePropertyDetector {
@Override
public boolean isEncrypted(String value) {
if (value != null) {
return value.startsWith("3DES@");
}
return false;
}
@Override
public String unwrapEncryptedValue(String value) {
return value.substring("3DES@".length());
}
}
private class MyEncryptablePropertyResolver implements EncryptablePropertyResolver {
private final PooledPBEStringEncryptor encryptor;
public MyEncryptablePropertyResolver() {
this.encryptor = new PooledPBEStringEncryptor();
SimpleStringPBEConfig config = new SimpleStringPBEConfig();
config.setPasswordCharArray("password".toCharArray());
config.setAlgorithm("3DES");
config.setKeyObtentionIterations("1000");
config.setPoolSize(1);
config.setProviderName("SunJCE");
config.setSaltGeneratorClassName("org.jasypt.salt.RandomSaltGenerator");
config.setStringOutputType("base64");
encryptor.setConfig(config);
}
@Override
public String resolvePropertyValue(String value) {
if (value != null && value.startsWith("{cipher}")) {
return encryptor.decrypt(value.substring("{cipher}".length()));
}
return value;
}
}}