JakartaEE Security Workshop/

...

/

Configuration Values

Configuration Values

Understand the details of configuration values and the key derivation function as password hashing.

We'll cover the following...

Overview

It is, of course, not good practice to hardcode passwords within the code. However, we’ve done it that way in our examples as a quick shortcut. The Security API allows an EL expression instead of a hardcoded value in the member values of the annotation. We should therefore specify the password (and other configuration values, such as the URL) as a reference to a CDI bean property.

password = "${configurationBean.ldapPassword}",

Once we have defined a CDI bean with the name configurationBean in our application, we can use getLdapPassword() to retrieve the value for the member.

Press + to interact
@ApplicationScoped
@Named
public class ConfigurationBean {
    public String getLdapPassword() {
        return ///
    }
}

Once we have established a method within a CDI bean, we have plenty of options to retrieve the value. We can use a database, properties file, or any other external system to retrieve the actual value of the password. That way, we avoid having some values hardcoded in the code.

Key derivation function as password hashing

In the lesson " ...