WildFly31中使用credential-reference配置数据源凭证的方法

在WildFly 26中，可在数据源的<security>标签内使用<user-name>和<password>标签配置凭证，同时结合<credential-reference>引用存储的密码，该配置可正常运行。但升级至WildFly 31后，上述标签被提示无效，疑似已被弃用或不再支持。尝试按文档将用户名和密码作为<security>标签的属性配置，却未生效。现需了解如何在WildFly 31的<security>标签内使用credential-reference配置用户名和密码，以实现凭证的安全隐藏。

WildFly 26 有效配置 #

<datasource enabled="true" jndi-name="java:/jdbc/bankstate_kghs" jta="true" pool-name="jdbc/bankstate_kghs" statistics-enabled="true" use-ccm="true" use-java-context="true" xmlns="urn:jboss:domain:datasources:7.0">
    <connection-url>jdbc:sqlserver://piligerwest1:1433;databaseName=master;trustServerCertificate=true;applicationName=bankstate</connection-url>
    <driver>bankstate</driver>
    <pool>
        <min-pool-size>0</min-pool-size>
        <max-pool-size>100</max-pool-size>
        <use-strict-min>false</use-strict-min>
        <prefill>false</prefill>
    </pool>
    <security>
        <user-name>admin</user-name>
        <credential-reference alias="bankstate-admin" store="bankstate_cred_store"/>
    </security>
    <validation>
        <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"/>
        <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLExceptionSorter"/>
        <background-validation-millis>120000</background-validation-millis>
        <background-validation>true</background-validation>
    </validation>
    <timeout>
        <idle-timeout-minutes>1</idle-timeout-minutes>
    </timeout>
</datasource>

WildFly 31 未生效的尝试配置 #

<datasource enabled="true" jndi-name="java:/jdbc/bankstate_gts" jta="true" pool-name="jdbc/bankstate_gts" statistics-enabled="true" use-ccm="true" use-java-context="true" xmlns="urn:jboss:domain:datasources:7.1">
    <connection-url>jdbc:sqlserver://piligerwest1:1433;databaseName=master;applicationName=bankstate</connection-url>
    <driver>bankstate10</driver>
    <pool>
        <min-pool-size>0</min-pool-size>
        <max-pool-size>100</max-pool-size>
        <use-strict-min>false</use-strict-min>
        <prefill>false</prefill>
    </pool>
    <security username="admin" password="Ajndnjenekdek">
    
    </security>
    <validation>
        <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"/>
        <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLExceptionSorter"/>
        <background-validation-millis>120000</background-validation-millis>
        <background-validation>true</background-validation>
    </validation>
    <timeout>
        <idle-timeout-minutes>1</idle-timeout-minutes>
    </timeout>
</datasource>

解决方案 #

WildFly 31对数据源配置的XML Schema进行了更新，移除了<security>标签下的<user-name>和<password>子元素，需采用以下两种方式配置：

方式1：明文用户名 + 凭证存储密码 #

如果用户名无需隐藏，仅密码通过凭证存储引用，可将用户名作为<security>标签的属性，同时保留<credential-reference>元素引用密码：

<datasource enabled="true" jndi-name="java:/jdbc/bankstate_gts" jta="true" pool-name="jdbc/bankstate_gts" statistics-enabled="true" use-ccm="true" use-java-context="true" xmlns="urn:jboss:domain:datasources:7.1">
    <connection-url>jdbc:sqlserver://piligerwest1:1433;databaseName=master;applicationName=bankstate</connection-url>
    <driver>bankstate10</driver>
    <pool>
        <min-pool-size>0</min-pool-size>
        <max-pool-size>100</max-pool-size>
        <use-strict-min>false</use-strict-min>
        <prefill>false</prefill>
    </pool>
    <security username="admin">
        <credential-reference alias="bankstate-admin" store="bankstate_cred_store"/>
    </security>
    <validation>
        <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"/>
        <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLExceptionSorter"/>
        <background-validation-millis>120000</background-validation-millis>
        <background-validation>true</background-validation>
    </validation>
    <timeout>
        <idle-timeout-minutes>1</idle-timeout-minutes>
    </timeout>
</datasource>

方式2：用户名和密码均通过凭证存储引用 #

如果用户名也需要隐藏，可为用户名和密码分别指定凭证存储的别名，并通过type属性区分类型：

<datasource enabled="true" jndi-name="java:/jdbc/bankstate_gts" jta="true" pool-name="jdbc/bankstate_gts" statistics-enabled="true" use-ccm="true" use-java-context="true" xmlns="urn:jboss:domain:datasources:7.1">
    <connection-url>jdbc:sqlserver://piligerwest1:1433;databaseName=master;applicationName=bankstate</connection-url>
    <driver>bankstate10</driver>
    <pool>
        <min-pool-size>0</min-pool-size>
        <max-pool-size>100</max-pool-size>
        <use-strict-min>false</use-strict-min>
        <prefill>false</prefill>
    </pool>
    <security>
        <credential-reference alias="bankstate-admin-username" store="bankstate_cred_store" type="username"/>
        <credential-reference alias="bankstate-admin-password" store="bankstate_cred_store" type="password"/>
    </security>
    <validation>
        <valid-connection-checker class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLValidConnectionChecker"/>
        <exception-sorter class-name="org.jboss.jca.adapters.jdbc.extensions.mssql.MSSQLExceptionSorter"/>
        <background-validation-millis>120000</background-validation-millis>
        <background-validation>true</background-validation>
    </validation>
    <timeout>
        <idle-timeout-minutes>1</idle-timeout-minutes>
    </timeout>
</datasource>

注意事项 #

• 确保WildFly配置中已正确定义凭证存储bankstate_cred_store，且对应别名已存储正确的用户名/密码值。
• 若之前直接使用password属性未生效，需检查凭证存储的配置是否正确，或是否存在权限问题导致无法读取凭证。

内容的提问来源于stack exchange，提问作者john smith