Spring Data JPA连接Oracle：无DB密码仅用SSL信任库配置咨询

核心思路 #

Spring Data JPA底层依赖数据源配置，只需在数据源层面配置SSL相关属性，JPA层保持常规配置即可，无需修改JPA核心逻辑。

1. 依赖配置 #

确保项目中包含Spring Data JPA、Oracle JDBC驱动及默认连接池（HikariCP）依赖：

<!-- Maven 示例 -->
<dependencies>
    <dependency>
        <groupId>org.springframework.boot</groupId>
        <artifactId>spring-boot-starter-data-jpa</artifactId>
    </dependency>
    <dependency>
        <groupId>com.oracle.database.jdbc</groupId>
        <artifactId>ojdbc8</artifactId>
        <scope>runtime</scope>
    </dependency>
</dependencies>

2. 数据源SSL属性配置 #

在application.yml或application.properties中配置数据源，通过connectionProperties传入SSL参数，不配置spring.datasource.password：

application.yml 示例 #

spring:
  datasource:
    url: jdbc:oracle:thin:@//<Oracle主机>:<端口>/<服务名>?ssl=true
    driver-class-name: oracle.jdbc.OracleDriver
    username: <数据库用户名>
    # 不配置spring.datasource.password
    hikari:
      connection-properties: |
        javax.net.ssl.trustStore=<证书文件绝对路径，如/opt/certs/truststore.jks>
        javax.net.ssl.trustStoreType=JKS
        javax.net.ssl.trustStorePassword=<证书密码>
  jpa:
    hibernate:
      ddl-auto: update # 根据实际需求调整，如none、create
    show-sql: true
    properties:
      hibernate:
        format_sql: true
        dialect: org.hibernate.dialect.Oracle12cDialect

application.properties 示例 #

spring.datasource.url=jdbc:oracle:thin:@//<Oracle主机>:<端口>/<服务名>?ssl=true
spring.datasource.driver-class-name=oracle.jdbc.OracleDriver
spring.datasource.username=<数据库用户名>
# 不配置spring.datasource.password
spring.datasource.hikari.connection-properties=javax.net.ssl.trustStore=<证书路径>&javax.net.ssl.trustStoreType=JKS&javax.net.ssl.trustStorePassword=<证书密码>

spring.jpa.hibernate.ddl-auto=update
spring.jpa.show-sql=true
spring.jpa.properties.hibernate.format_sql=true
spring.jpa.properties.hibernate.dialect=org.hibernate.dialect.Oracle12cDialect

3. 证书密码加密加载（可选） #

如果证书密码需从加密文件读取，可自定义数据源配置类实现：

import com.zaxxer.hikari.HikariDataSource;
import org.springframework.boot.context.properties.ConfigurationProperties;
import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.core.io.Resource;
import org.springframework.core.io.ResourceLoader;

import java.io.IOException;
import java.nio.charset.StandardCharsets;

@Configuration
public class DataSourceConfig {

    private final ResourceLoader resourceLoader;

    public DataSourceConfig(ResourceLoader resourceLoader) {
        this.resourceLoader = resourceLoader;
    }

    @Bean
    @ConfigurationProperties(prefix = "spring.datasource")
    public HikariDataSource dataSource() throws IOException {
        HikariDataSource dataSource = new HikariDataSource();
        // 从文件读取加密密码，实际场景替换为解密逻辑
        Resource passwordResource = resourceLoader.getResource("file:/opt/certs/truststore-password.txt");
        String trustStorePassword = new String(passwordResource.getInputStream().readAllBytes(), StandardCharsets.UTF_8).trim();
        
        String connectionProps = String.format(
            "javax.net.ssl.trustStore=%s&javax.net.ssl.trustStoreType=JKS&javax.net.ssl.trustStorePassword=%s",
            "/opt/certs/truststore.jks", trustStorePassword
        );
        dataSource.setConnectionProperties(connectionProps);
        return dataSource;
    }
}

注意：此时需删除配置文件中的hikari.connection-properties配置，避免冲突。

4. 连接验证 #

编写简单的JPA组件验证连接：

// 实体类示例
import jakarta.persistence.Entity;
import jakarta.persistence.Id;

@Entity
public class TestEntity {
    @Id
    private Long id;
    private String name;

    // getter、setter、构造方法省略
}

// Repository示例
import org.springframework.data.jpa.repository.JpaRepository;

public interface TestEntityRepository extends JpaRepository<TestEntity, Long> {
}

// 测试类示例
import org.junit.jupiter.api.Test;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.boot.test.context.SpringBootTest;

@SpringBootTest
public class ConnectionTest {

    @Autowired
    private TestEntityRepository repository;

    @Test
    public void testConnection() {
        // 执行查询验证连接有效性
        repository.count();
    }
}

内容的提问来源于stack exchange，提问作者Muralidhar