Mailing-List: contact dev-help@directory.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Apache Directory Developers List" <dev@directory.apache.org>
Received-SPF: pass (herse.apache.org: domain of ole.ersoy@gmail.com designates
 66.249.82.227 as permitted sender)
DomainKey-Signature: a=rsa-sha1; c=nofws;
        d=gmail.com; s=beta;
        h=received:message-id:date:from:user-agent:mime-version:to:subject:content-type:content-transfer-encoding;
        b=dGDQdBHzMTYX8Py/ynzdSW0gOXla7RZdHzan2qa06fmP4dNybhtx/i6kLyauxi/rD5+ohTEkcLQOw1R4CrAzBsxgKG/2/qaqyCHmO/s8G2X2Kyh8TKST3VIV9Yh3lHSlvVgBHDwjBx7JEgl95puVgBxHZKe/cnHnY1d65gtDNME=
Message-ID: <461D406D.4010401@gmail.com>
Date: Wed, 11 Apr 2007 15:09:17 -0500
From: Ole Ersoy <ole.ersoy@gmail.com>
User-Agent: Thunderbird 1.5.0.10 (X11/20070302)
MIME-Version: 1.0
To: Apache Directory Developers List <dev@directory.apache.org>
Subject: [DAS] Password Encryption
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit

Hey Guys,

The DAS reads the JNDI connection's password
form the DAS's configuration file.

Right now I have the default set to "secret",
in plain text.

I'm thinking there should be a small utility
that comes with the DAS that generates a checksum (md5, sha1)
of the password that the user wants, and then the user
puts that in the configuration file.

After the DAS reads the configuration file, it decrypts
the password and adds it to the environment map used
by the connection.

Ideally the property used to store the decrypted password
is write only.  I think java security has some stuff for that,
but I gotta investigate.

Sound ok?

Thanks,
- Ole