I'm writing an application which would allow users to access the databases over the network. Currently the user enters database details in a form which are later used to establish a JDBC connection. The details I obtain are (1) database host name, (2) username, (3) password, (4) certain other config parameters. Apart from this, there will be a set of predefined queries which would run on the database that user requests. I generate the jdbc connection string on the fly, create a connection, and run the required query. Before you start bashing, I know this is not a good practice and highly unsecure.
I couldn't find any questions which are directly relevant. I found this answer which says repeats my thought but doesn't deal with this scenario.
Here's an explanation of the problem (use case):
- A high privilege user can provide me remote/target database connection details which would be encrypted.
- Regular or low privilege user can't add,see,or edit these details
- There will be multiple target databases. The number can't be predetermined.
- My program logic decides which DB to send the query to. The queries will only be select queries.
Another potential problem is handling multiple jdbc connectors (consider oracle, mysql, mssql etc).
What solution would you propose that allows an effective way to connect to multiple databases with their respective jdbc drivers while not compromising with the security of the target databases? Is there a way to authenticate like web applications use OAuth or Certificates?