Encrypt ConfigAdmin properties values in Apache Karaf

Apache Karaf loads all the configuration from etc/*.cfg files by default, using a mix of Felix FileInstall and Felix ConfigAdmin.

These files are regular properties file looking like:

key=value

Some values may be critical, and so not store in plain text. It could be critical business data (credit card number, etc), or technical data (password to different systems, like database for instance).

We want to encrypt such kind of data in the etc/*.cfg files, but being able to use it regulary in the application.

Karaf provides a nice feature for that: jasypt-encryption.

It’s very easy to use especially with Blueprint.

The jasypt-encryption feature is an optional feature, so it means that you have to install it first:

karaf@root()> feature:install jasypt-encryption

This feature provides:

• jasypt bundle
• a namespace handler (enc:*) for blueprint

Now, we can create a cfg file containing encrypted value. The encrypted value is “wrapped” in a ENC() function.

For instance, we can create etc/my.cfg file containing:

mydb.url=host:portmydb.username=usernamemydb.password=ENC(zRM7Pb/NiKyCalroBz8CKw==)

In the Blueprint descriptor of our application (like a Camel route Blueprint XML for instance), we use the “regular” cm namespace (to load ConfigAdmin), but we add a Jasypt configuration using the enc namespace.

For instance, the blueprint XML could look like:

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"           xmlns:cm="http://aries.apache.org/blueprint/xmlns/blueprint-cm/v1.1.0"           xmlns:enc="http://karaf.apache.org/xmlns/jasypt/v1.0.0">  <cm:property-placeholder persistent-id="my" update-strategy="reload">    <cm:default-properties>      <cm:property name="mydb.url" value="localhost:9999"/>      <cm:property name="mydb.username" value="sa"/>      <cm:property name="mydb.password" value="ENC(xxxxx)"/>    </cm:default-properties>  </cm:property-placeholder>  <enc:property-placeholder>    <enc:encryptor class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">      <property name="config">        <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">          <property name="algorithm" value="PBEWithMD5AndDES"/>          <property name="passwordEnvName" value="ENCRYPTION_PASSWORD"/>        </bean>      </property>    </enc:encryptor>  </enc:property-placeholder>  <bean id="dbbean" class="...">    <property name="url" value="${mydb.url}"/>    <property name="username" value="${mydb.username}"/>    <property name="password" value="${mydb.password}"/>  </bean>  <camelContext xmlns="http://camel.apache.org/schemas/blueprint">     <route>        ...        <process ref="dbbean"/>        ...     </route>  </camelContext></blueprint>

It’s also possible to use encryption not in ConfigAdmin, directly loading an “external” properties file using the ext blueprint namespace:

<blueprint xmlns="http://www.osgi.org/xmlns/blueprint/v1.0.0"           xmlns:ext="http://aries.apache.org/blueprint/xmlns/blueprint-ext/v1.0.0"           xmlns:enc="http://karaf.apache.org/xmlns/jasypt/v1.0.0">  <ext:property-placeholder>    <ext:location>file:etc/db.properties</ext:location>  </ext:property-placeholder>  <enc:property-placeholder>    <enc:encryptor class="org.jasypt.encryption.pbe.StandardPBEStringEncryptor">      <property name="config">        <bean class="org.jasypt.encryption.pbe.config.EnvironmentStringPBEConfig">          <property name="algorithm" value="PBEWithMD5AndDES"/>          <property name="passwordEnvName" value="ENCRYPTION_PASSWORD"/>        </bean>      </property>    </enc:encryptor>  </enc:property-placeholder>  ...</blueprint>

where etc/db.properties looks like:

mydb.url=host:portmydb.username=usernamemydb.password=ENC(zRM7Pb/NiKyCalroBz8CKw==)

It’s also possible to use directly the ConfigAdmin in code. In that case, you have to create the Jasypt configuration programmatically:

StandardPBEStringEncryptor enc = new StandardPBEStringEncryptor();EnvironmentStringPBEConfig env = new EnvironmentStringPBEConfig();env.setAlgorithm("PBEWithMD5AndDES");env.setPassword("ENCRYPTION_PASSWORD");enc.setConfig(env);...