Java（JDBC/JNDI）数据库连接加密账号密码配置异常求助

环境与需求 #

• Java 1.8、Tomcat 8.5、MySQL 8
• 需要将数据库连接配置中的明文用户名/密码替换为加密内容，移除factory属性后使用明文可正常运行

数据库连接配置 #

<Resource name="jdbc/db" auth="Container" type="javax.sql.DataSource" maxTotal="100" maxIdle="30" maxWaitMillis="10000" username="encrypted_username" password="encrypted_password" driverClassName="com.mysql.cj.jdbc.Driver" url="jdbc:mysql://localhost:3306/rdbms" factory="abc.decrptAndReplace" />

自定义ObjectFactory类代码 #

package abc;

import java.util.Enumeration;
import java.util.Hashtable;
import javax.naming.Context;
import javax.naming.Name;
import javax.naming.RefAddr;
import javax.naming.Reference;
import javax.naming.StringRefAddr;
import javax.naming.spi.ObjectFactory;

public class decrptAndReplace implements ObjectFactory {

    public decrptAndReplace() {}

    @Override
    public Object getObjectInstance(final Object obj, final Name name, final Context nameCtx, final Hashtable environment) throws Exception {
        if (obj instanceof Reference) {
            setUsername((Reference) obj);
            setPassword((Reference) obj);
        }
        return this.getObjectInstance(obj, name, nameCtx, environment);
    }

    private void setUsername(final Reference ref) throws Exception {
        findDecryptAndReplace("username", ref);
    }

    private void setPassword(final Reference ref) throws Exception {
        findDecryptAndReplace("password", ref);
    }

    private void findDecryptAndReplace(final String refType, final Reference ref) throws Exception {
        final int idx = find(refType, ref);
        final String decrypted = decrypt(idx, ref);
        replace(idx, refType, decrypted, ref);
    }

    private void replace(final int idx, final String refType, final String newValue, final Reference ref) throws Exception {
        ref.remove(idx);
        ref.add(idx, new StringRefAddr(refType, newValue));
    }

    private String decrypt(final int idx, final Reference ref) throws Exception {
        return "plain_password/plain_username";
    }

    private int find(final String addrType, final Reference ref) throws Exception {
        final Enumeration enu = ref.getAll();
        for (int i = 0; enu.hasMoreElements(); i++) {
            final RefAddr addr = (RefAddr) enu.nextElement();
            if (addr.getType().compareTo(addrType) == 0) {
                return i;
            }
        }

        throw new Exception(ref.toString());
    }
}

遇到的错误 #

Unexpected exception resolving reference

问题分析与解决方案 #

核心问题 #

getObjectInstance方法存在无限递归调用：处理完Reference后，又重复调用自身方法，形成死循环，最终抛出意外异常。

修复步骤 #

1. 修改getObjectInstance逻辑，处理完加密内容替换后，调用Tomcat原生数据源工厂创建实例：

@Override
public Object getObjectInstance(final Object obj, final Name name, final Context nameCtx, final Hashtable<?, ?> environment) throws Exception {
    if (obj instanceof Reference) {
        Reference ref = (Reference) obj;
        // 解密替换用户名和密码
        setUsername(ref);
        setPassword(ref);
        
        // 获取Tomcat默认的数据源工厂类并创建实例
        Class<?> factoryClass = Class.forName(ref.getFactoryClassName());
        ObjectFactory factory = (ObjectFactory) factoryClass.newInstance();
        // 委托原生工厂创建数据源
        return factory.getObjectInstance(obj, name, nameCtx, environment);
    }
    return null;
}

2. 完善decrypt方法的实际解密逻辑（当前仅返回固定字符串，需替换为真实解密代码）：

private String decrypt(final int idx, final Reference ref) throws Exception {
    RefAddr addr = ref.get(idx);
    String encryptedValue = (String) addr.getContent();
    // 替换为你的解密实现，比如AES解密、BASE64解码等
    // 示例：return AESDecryptUtil.decrypt(encryptedValue, "your-secret-key");
    return "实际明文用户名/密码";
}

3. 确保自定义工厂类的字节码文件或jar包放置在Tomcat的lib目录，或应用的WEB-INF/lib目录中，保证类加载能找到该类。

额外建议 #

• 类名遵循Java规范改为DecryptAndReplace（首字母大写）
• 解密密钥避免硬编码，可通过环境变量或配置文件安全读取

内容的提问来源于stack exchange，提问作者R K