Skip to main content
Version: 5.0.1.0

Derby

Per default, the Orchestra Solution Hub is operated on the basis of an integrated Derby database. This database is stored in the local file system.

Derby Standard Security​

The database is operated in the default Derby security mode, which does not require database authentication. Solution Hub uses the database in embedded mode. This means that the database is opened within the Solution Hub processes itself and no public network endpoints are needed. This fact guarantees that no access over a network is possible.

Improved Security​

Only in the case that an attacker has direct access to the local file system, one can read the content and open the databases. If this behavior is not sufficient, an improved security mode can be established. This mode enforces password authentication for the whole database even in case the system is copied. In order to activate this mode, please follow the following instructions:

Open the database with the ij-command line tool <https://db.apache.org/derby/papers/DerbyTut/ij_intro.html> and execute the following commands.

Replace the following placeholders with parameters specific to your database:

  • <path-to-derby-database-directory>: Replace this parameter with the absolute path to your database directory
  • <PASSWORD>: The password that shall be used for the authentication

Step 1​

ij> connect 'jdbc:derby:<path-to-derby-database-directory>';
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.SOLUTIONHUB', '<PASSWORD>');
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication', 'true');
ij> disconnect;

Step 2​

Change the database password (database.runtime.pwd) parameter in the environment_settings.xml of the installation to the password that you have set. Please encrypt the password with the password tool provided by Orchestra.

Change the database user (database.runtime.user) parameter in the environment_settings.xml of the installation to SOLUTIONHUB. Please encrypt the user with the password tool provided by Orchestra.

Encrypted Derby Database with Auto Install​

Only in case that an attacker has direct access to the local file system, one can read the content and open the databases. If this behavior is not sufficient, an improved security mode can be established. This section describes how the Derby database can be setup in encrypted mode. In this mode, all database files are encrypted by use of an initial boot password.

Details can be found at <https://db.apache.org/derby/docs/10.0/manuals/develop/develop115.html>.

:::info Important: The described installation steps can only be used to create a database from scratch. The procedure cannot be applied to an existing database. :::

Open the database with the ij-command line tool <https://db.apache.org/derby/papers/DerbyTut/ij_intro.html> and execute the following commands.

Please replace the following placeholders with parameters specific to your database:

  • <path-to-derby-database-directory>: Replace this parameter with the absolute path to your database directory
  • <PASSWORD>: The password that shall be used for authentication
  • <BOOTPASSWORD>: The password that shall be used for the encryption of the database

Step 1: Create an initial Derby database in encrypted mode​

ij> connect 'jdbc:derby:<path-to-derby-database-directory>;create=true;dataEncryption=true;bootPassword=<BOOTPASSWORD> user 'SOLUTIONHUB' password <PASSWORD>'
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.SOLUTIONHUB', '<PASSWORD>');
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication', 'true');
ij> disconnect;

Step 2: Configure Orchestra Solution Hub properly and ensure that the auto.install mode creates all required database tables​

  • Change the database password (database.runtime.pwd) parameter in the environment_settings.xml of the installation to the password that you have set. Please encrypt the password with the password tool provided by Orchestra.

  • Change the database user (database.runtime.user) parameter in the environment_settings.xml to SOLUTIONHUB. Please encrypt the username with the password tool provided by Orchestra.

  • Set the auto install flag (database.auto.install) to true. This ensures that the database is created automatically during startup.

    <parameter name="auto.install" value="true"/>

  • Change the database URL (database.runtime.url) parameter in the environment_settings.xml of the Orchestra Solution Hub installation. The URL has the following format:

    jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword=ThisIsTheBootPassword

  • If the BOOTPASSWORD shall be given literally, the URL has the following format:

    jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword=ThisIsTheBootPassword

  • If the BOOTPASSWORD shall be given by an operating system variable, the URL has the following format, while <NameOfOsVariable> has to be replaced by the name of the operating system variable:

    jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword={system.<NameOfOsVariable>}

  • If the BOOTPASSWORD shall be given by a Java command line parameter, the URL has the following format, while <NameOfProperty> has to be replaced by the name of the Java start parameter (java -DNameOfProperty=ThisIsTheBootPassword):

    jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword={property.<NameOfProperty>}

Encrypted Derby Database with Flyway​

Only in case that an attacker has direct access to the local file system, one can read the content and open the databases. If this behavior is not sufficient, an improved security mode can be established. This section describes how the Derby database can be setup in encrypted mode. In this mode, all database files are encrypted by use of an initial boot password. Details can be found at <https://db.apache.org/derby/docs/10.0/manuals/develop/develop115.html>.

:::info Important:

  • The described installation steps can only be used to create a database from scratch.
  • The procedure cannot be applied to an existing database.
  • The Flyway approach can be used to create a Derby database independent of the Orchestra Solution Hub.

:::

The basic approach is described under Flyway DB Migration and Versioning.

Please replace the following placeholders with parameters specific to your database:

  • <path-to-derby-database-directory>: Replace this parameter with the absolute path to your database directory
  • <PASSWORD>: The password that shall be used for authentication
  • <BOOTPASSWORD>: The password that shall be used for the encryption of the database

Step 1: Create an initial Derby database that works in encrypted mode​

flyway.url=jdbc:derby:<path-to-derby-database-directory>;create=true;dataEncryption=true;bootPassword=<BOOTPASSWORD>
flyway.password=<PASSWORD>
flyway.user=SOLUTIONHUB
flyway.locations=filesystem:../Derby

Step 2: Enable password authentication for the created database​

ij> connect 'jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword=<BOOTPASSWORD>'
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.user.SOLUTIONHUB', '<PASSWORD>');
ij> CALL SYSCS_UTIL.SYSCS_SET_DATABASE_PROPERTY('derby.connection.requireAuthentication', 'true');
ij> disconnect;

Step 3: Configure Orchestra Solution Hub properly and ensure that the auto.install mode creates all required database tables​

  • Change the database password (database.runtime.pwd) parameter in the environment_settings.xml of the installation to the password that you have set. Please encrypt the password with the password tool provided by Orchestra.

  • Change the database user (database.runtime.user) parameter in the environment_settings.xml of the installation to SOLUTIONHUB. Please encrypt the username with the password tool provided by Orchestra.

  • Change the database URL (database.runtime.url) parameter in the environment_settings.xml of the installation. The given URL has the following format:

    jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword=<BOOTPASSWORD>

    • If the BOOTPASSWORD shall be given in plain text, the URL has the following format:

      jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword=ThisIsTheBootPassword

    • If the BOOTPASSWORD shall be given by an operating system variable, the URL has the following format, while <NameOfOsVariable> has to be replaced by the name of the operating system variable:

      jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword={system.<NameOfOsVariable>}

    • If the BOOTPASSWORD shall be given by a Java command line parameter, the URL has the following format, while <NameOfProperty> has to be replaced by the name of the Java start parameter (java -DNameOfProperty=ThisIsTheBootPassword):

      jdbc:derby:<path-to-derby-database-directory>;dataEncryption=true;bootPassword={property.<NameOfProperty>}