Credential Store using Hibernate file

Introduction

Hibernate file configuration store the Database information. Database accounts, passwords and URLs are specified in hibernate file .

Hibernate file configuration: 

• The following hibernate configuration files are available with JobScheduler Master and JOC Cockpit:
  • JobScheduler run-time database: hibernate.cfg.xml

  • Reporting database: reporting.hibernate.cfg.xml 

• Database accounts, passwords and URLs are specified as plain text with the above hibernate configuration files. 
• Hibernate configuration file also support Credential Store. Availability from release 1.12.12 and 1.13.3 

Create a custom hibernate file which access the Database accounts, password and URL from the Credential Store.

URI

cs://<entry_path>@<property_name> - required 

• The URI based syntax includes the protocol cs:// 
• followed by the <entry_path> that specifies the directory structure and entry name in the credentials store file.
• followed by the @ character

• followed by the <property_name> that should be retrieved:

  • frequently used properties include credential store field names such as title, user, password,attachment Custom field names are supported. 

Query Parameters

• file - required 
  the path to the credential store database file. This file can be stored anywhere in the file system.

• password - optional 
  the password for the credential store database file. 
  It is recommended not to use this parameter and instead to use a key_file to access the credential store.

• key_file - optional, default: <credential_store_database_filename_without_extension>.key 

For detailed information about query parameter Query Parameters.

Syntax:

Full syntax: 

• <property name="hibernate.connection.password">cs://<entry_path>@user?file=some/path/database.kdbx</property> 
• <property name="hibernate.connection.password">cs://<entry_path>@password?file=some/path/database.kdbx</property>

• <property name="hibernate.connection.url">cs://<entry_path>@url?file=some/path/database.kdbx</property>

Alternatively, use the short syntax in the hibetnate file : 

• <property name="hibernate.connection.username">cs://@user</property> 
• <property name="hibernate.connection.password">cs://@password</property> 
• <property name="hibernate.connection.url">cs://@url</property>

       Inroducing new hibernate configuration credential store items for the Short syntax:

• <property name="hibernate.sos.credential_store_file">some/path/database.kdbx</property> 
• <property name="hibernate.sos.credential_store_key_file">some/path/database.key</property> 
• <property name="hibernate.sos.credential_store_password">some password</property> 
• <property name="hibernate.sos.credential_store_entry_path">/some/entry/path</property> 

Save the custom hibernate.cfg.xml file on any location and assign the path of hibernate file in the job parameter. 

Example of hibernate file that uses KeePass for access database credential

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<hibernate-configuration>
<session-factory>
<property name="hibernate.connection.url"><![CDATA[cs://server/test/reporting/MySQL@url?file=config/cs/kdbx-p-f.kdbx&password=test]]></property>
<property name="hibernate.connection.username"><![CDATA[cs://server/prod/reporting/MySQL@username?file=config/cs/kdbx-p-f.kdbx&password=test]]></property>
<property name="hibernate.connection.password"><![CDATA[cs://server/test/reporting/MySQL@password?file=config/cs/kdbx-p-f.kdbx&password=test]]></property>

<property name="hibernate.connection.driver_class">org.mariadb.jdbc.Driver</property>
<property name="hibernate.dialect">org.hibernate.dialect.MySQLInnoDBDialect</property>
<property name="hibernate.show_sql">false</property>
<property name="hibernate.connection.autocommit">false</property>
<property name="hibernate.format_sql">true</property>
<property name="hibernate.temp.use_jdbc_metadata_defaults">false</property>
</session-factory>
</hibernate-configuration>

Explanations

• Hibernate file make use of kdbx KeePass database for accessing Database credential
• <entry_path> of the kdbx database of KeePass Credential Store
• file-File path of kdbx keepass database.
• password- Password for accesing kdbx database where credentials store

Example of hibernate file with a key file for the credential store database file.  

<?xml version="1.0" encoding="UTF-8" standalone="no"?> 
<hibernate-configuration> 
<session-factory> 
<property name="hibernate.connection.url"><![CDATA[cs://kdbx-p-f/MySQL@url?file=./config/live/keepass/kdbx-p-f.kdbx]]></property> 
<property name="hibernate.connection.username"><![CDATA[cs://kdbx-p-f/MySQL@username?file=./config/live/keepass/kdbx-p-f.kdbx]]></property> 
<property name="hibernate.connection.password"><![CDATA[cs://kdbx-p-f/MySQL@password?file=./config/live/keepass/kdbx-p-f.kdbx]]></property> 
<property name="hibernate.connection.driver_class">org.mariadb.jdbc.Driver</property> 
<property name="hibernate.dialect">org.hibernate.dialect.MySQLInnoDBDialect</property> 
<property name="hibernate.show_sql">false</property> 
<property name="hibernate.connection.autocommit">false</property>  
<property name="hibernate.format_sql">true</property> 
<property name="hibernate.temp.use_jdbc_metadata_defaults">false</property> 
</session-factory> 
</hibernate-configuration> 

Explanations

• Hibernate file make use of kdbx Key file for accessing Database credential
• <entry_path> path where the MySQL database credential stores.
• file-File path where the kdbx key file stores.