In JasperReports Server version 5.5 or greater, a new feature allows administrators to obfuscate passwords that appear in the configuration files. This satisfies security audit requirements and protects the passwords from being observed by unauthorized individuals. Typically, the following are encrypted:

You can also change the configuration to encrypt the following:

Passwords in configuration files are encrypted during JasperReports Server installation. If the installation deploys to the Tomcat application server, the database password is automatically encrypted in the JNDI configuration as well (in the file context.xml).

Encrypting Configuration Passwords on Tomcat (or Spring tcServer)

To encrypt passwords in a Tomcat or tcServer installation, modify the installation procedure as follows:

from: <js-install>/buildomatic/sample_conf/<database>_master.properties

to: <js-install>/buildomatic/default_master.properties

Encrypting Configuration Passwords on Enterprise Servers

Most enterprise servers, such as JBoss, Glassfish, WebSphere, and WebLogic, have proprietary ways to set up password encryption. You should use these encryption methods. JasperReports Server does not automatically set up encrypted passwords for these servers during deployment. In this case, you can additionally encrypt the passwords in the buildomatic file after deployment:

Encrypting Additional Properties in default_master.properties

You can encrypt additional properties in the default_master.properties file. To work correctly, these properties need to be decrypted when they are used. Currently, decryption is supported for properties that are loaded into the Spring application context via the propertyConfigurer bean in applicationContext-webapp.xml.

The following code sample shows the propertyConfigurer bean in applicationContext-webapp.xml:

Because Jaspersoft extended Spring's PropertyPlaceholderConfigurer class as DecryptingPropertyPlaceholderConfigurer, all the loaded properties are scanned for the special marker ENC-<value>-. If that marker is found around the property value, that property is decrypted before being loaded into Spring context.

To determine if your property is scanned by propertyConfigurer, search the files in propertyConfigurer's locations to see if it is defined in one of these files.

For example, suppose you want to encrypt the password property of the reportSchedulerMailSender bean in applicationContext-report-scheduling.xml:

${report.scheduler.mail.sender.password} tells you that report.scheduler.mail.sender.password is most likely defined via the propertyConfigurer bean. Search through the propertyConfigurer locations to verify. This property is defined in /WEB-INF/js.quartz.properties as follows: report.scheduler.mail.sender.password=${quartz.mail.sender.password}.

Once you have verified that the quartz.mail.sender.password property can be encrypted using default-master.properties, you set up encryption prior to installation as follows:

quartz.mail.sender.password=XXYYZZ

Password Encryption for External Authentication

As of JasperReports Server 5.6, it's possible to encrypt the passwords in the external authentication configuration files for LDAP and external database authentication. To do this, we introduced context properties to the sample configuration files instead of simple strings. For example, if you are using LDAP to authenticate, the sample configuration file contains the following:

The values referenced by the ${...} format are defined in the js.externalAuth.properties file and are imported into Spring context via the propertyConfigurer. For example, the LDAP properties are defined in js.externalAuth.properties as follows:

The ${...} values can be configured in default_master.properties before installation or upgrade. The following example shows the syntax of the properties in the default_master.properties file:

To encrypt the password property, you would also set the following:

external.ldapPassword=XXYYZZencrypt=true propsToEncrypt=dbPassword, external.ldapPassword[/code]                    

Encryption Options

In buildomatic installation scripts, the passwords are symmetrically encrypted: the same secret key is used for both encryption and decryption. The key and its containing keystore file are randomly generated on each machine during the first JasperReports Server installation. All the subsequent JasperReports Server installations on the same server rely on the same keystore; they do not regenerate the key.

The keystore is an encrypted file that is used to securely store secret keys. To access the keystore, JasperReports Server accesses keystore properties. Both the keystore and keystore properties files are created by default in the user home directory. Alternatively, before running js-install, you can specify different locations for the keystore and keystore properties files via the environmental variables ks and ksp, respectively.

By default, database passwords are encrypted with the AES-128 algorithm in Cipher Block Chaining mode with PKCS5 padding. The AES algorithm is the current industry encryption standard. You can choose to modify the encryption strength by choosing either a different algorithm, a longer secret key size (for example AES-256), or a different encryption mode.

Edit the following properties in your default_master.properties set these options. If a property is commented out, the default is used: