Connection pooling in Tomcat

Question

Hello all,
I've been using tomcat 5.0.27 and for quite sometime now using the connection pooling on tomcat as well.
I configure DataSource(no.of connections,username, password etc) by logging into tomcat admin console.
But what I've seen is it adds datasource configuration data into server.xml - including the username and password to the database(which will be supplied to the driver by the container when creating a connection). But I don't want the username and password to be present in the xml file (i.e. in clear text format). Is it possible to somehow give the password and the username when requesting for a connection i.e. datasource.getConnection and not while configuring the pool and still get it working?
Please guide me.
Thanks,

Answer 1

Oh yeah. I've already tried it. It always seems to
get the connection with the credentials that I gave
while configuring the datasource. Whatever password I
pass in the call to getConnection - it is being
ignored.Do you have one already set in the server.xml? If so, try removing it (and restarting the server).
But an implication - the server might just decide to
have say x connections in the pool on startup. So if
you havent given the uname/password for the
database(when you configured the datasource) and give
the credentials only when getConnection is called in
your code - how will the server have those x
connections in the pool on startup?Probably won't It may wait to store the connections to the pool until x number of calls to the getConnection method are made (like a lazy initialization). But I don't know, just getting around to testing now.
I have people telling me that having uname/password to
the database in server.xml doesn't augur well for the
security of data in the db :(It could be true, but
1) The only people to see the server.xml are those who work on the server. The server.xml (or better the context.xml if you can avoid editing the server.xml altogether) is not accessable from the web.
2) My strategy was always to create many different levels of access to any particular database. Some with Read Only access and limited table viewability, and then progressively higher access. You give the server.xml only the access they absolutely need. IE, if they are just retrieving data from a couple tables, make a read-only user with the ability to see only those tables...
Don't take my word for it though. I have never really tried to do the whole ultra-secure thing, my apps are not important.