0

I'm writing an application which would allow users to access the databases over the network. Currently the user enters database details in a form which are later used to establish a JDBC connection. The details I obtain are (1) database host name, (2) username, (3) password, (4) certain other config parameters. Apart from this, there will be a set of predefined queries which would run on the database that user requests. I generate the jdbc connection string on the fly, create a connection, and run the required query. Before you start bashing, I know this is not a good practice and highly unsecure.

I couldn't find any questions which are directly relevant. I found this answer which says repeats my thought but doesn't deal with this scenario.

Here's an explanation of the problem (use case):

  1. A high privilege user can provide me remote/target database connection details which would be encrypted.
  2. Regular or low privilege user can't add,see,or edit these details
  3. There will be multiple target databases. The number can't be predetermined.
  4. My program logic decides which DB to send the query to. The queries will only be select queries.

Another potential problem is handling multiple jdbc connectors (consider oracle, mysql, mssql etc).

What solution would you propose that allows an effective way to connect to multiple databases with their respective jdbc drivers while not compromising with the security of the target databases? Is there a way to authenticate like web applications use OAuth or Certificates?

8
  • 2
    What's your question? I understand your application's requirements, but I don't understand what you're asking of the SE community.
    – Dan Wilson
    Commented Oct 10, 2018 at 15:47
  • 1
    can you use kerbos auth?
    – Ewan
    Commented Oct 10, 2018 at 15:51
  • @Ewan not experienced with it but I remember I read about it back in the school. Will see if it is feasible as there will be DBAs as well as our clients' DBAs involved.
    – Aditya
    Commented Oct 10, 2018 at 15:57
  • so you can use windows auth with most dbs but its unclear if this would solve the problem. after all the user will still have to supply the rest of rhe connection string
    – Ewan
    Commented Oct 10, 2018 at 15:58
  • 1
    The process of securing a piece of software will typically start with a threat assessment. You need to list the possible attack vectors and come up with use cases for each. Then you come up with mitigations for each of the malicious use cases. It would greatly improve your question if you could list some of these in your post; otherwise, the question is far too broad.
    – John Wu
    Commented Oct 11, 2018 at 0:30

2 Answers 2

Reset to default
1

Many databases allow extensive customization of the authentication mechanism. To be more specific, many have LDAP integration, which makes things much simpler both for you (or your system administrator), because there is no need to have dedicated accounts in the database, and for your users (because they don't have to provide a separate password; they are just authenticated automatically).

Some databases support TLS client certificate authentication as well (Oracle is one of them). However, I wouldn't recommend it in your case, since this would put a lot of work on both the system administrator and the users, who will have to handle certificates—not the most usual or intuitive task. Expiration of certificates alone is such a cumbersome thing that should discourage you from using them in your particular situation.

Client certificates are better used in a context where the database is accessed by multiple applications, as opposed to users. Each of those applications have specific deployment procedures, custom configuration, API keys; here, having an additional certificate shouldn't be an issue. Although it's slightly more difficult to use compared to an API key, it is also slightly more secure, which makes it a good alternative.

1

allow users to access the databases over the network.

Which databases? Any database? Highly insecure and risky.

One of a pre-defined list of Databases - that's a batter starting point.

(1) database host name, (2) username, (3) password, (4) certain other config parameters.

Why should your users know (or care) where their database is hosted? What if it changes? Users are suddenly unable to access their data because you've [legitimately] moved it elsewhere (and probably at their request!).

I generate the jdbc connection string on the fly, create a connection, and run the required query.

And, I would say, that's entirely reasonable.

The point is; how much does the user need to know / supply in order to get what they want?

They should select a Database (by some meaningful description) and your Application should work out all the other "config parameters" based on that. Add their Username and Password and you've got everything you need to do what you already do, but in a far more secure fashion. They can't start opening JDBC connections to any old database they happen to know about because you don't give them the option to choose it.

Also consider whether you want to create actual Database accounts for each and every user in each and every database that this Application can access. Also, how do you deal with expired /forgotten password requests? I would suggest using an "Application" account (that Users are unaware of) that has all the database access and your Users are managed within the Application itself.

2
  • Thanks for the answer. Answering your questions so that you could edit if you have time. The application I'm building aggregates some information from these multiple databases - users are engineers/DBAs etc who will have a single-point-of-information through this app. They are in-charge of these databases however have a hierarchy of privileges.
    – Aditya
    Commented Oct 11, 2018 at 12:14
  • Admin users will be aware of where the database is hosted so that they can edit it in my app later. Low privilege users don't care about this.
    – Aditya
    Commented Oct 11, 2018 at 12:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.