Jasypt

Spring Boot auto-configuration for Camel Jasypt encrypted properties.

This starter integrates Jasypt with both Camel’s property placeholder mechanism and Spring Boot’s Environment, so that encrypted values in application.properties (or YAML) are decrypted transparently at runtime. Encrypted values use the ENC(…​) syntax.

Maven coordinates

<dependency>
    <groupId>org.apache.camel.springboot</groupId>
    <artifactId>camel-jasypt-starter</artifactId>
</dependency>

Usage

Add encrypted values to your application.properties using the ENC(…​) syntax, and point the starter at the master password:

my.secret = ENC(encrypted-value-here)
camel.component.jasypt.password = sysenv:JASYPT_PASSWORD
The master password must never be stored in the same file, or the same repository, as the encrypted values it protects. A file that carries both the ciphertext and the key that unlocks it is no better than a plaintext file. Supply the master password from the environment or from an external secret store at deployment time.

camel.component.jasypt.password understands two prefixes that keep the password out of the configuration file:

  • sysenv:<name> looks the password up in the OS environment variable <name>.

  • sys:<name> looks the password up in the JVM system property <name>.

Any other value is used as the password verbatim, which is only appropriate when the property itself is injected by an external secret store (for example a mounted secret or a config server) rather than checked in.

Encryption algorithm

The default algorithm is PBEWITHHMACSHA256ANDAES_256. It requires an initialization vector, which the starter generates automatically (org.jasypt.iv.RandomIvGenerator) unless camel.component.jasypt.iv-generator-class-name is set explicitly.

Use Jasypt tooling to encrypt values, passing the same algorithm and a random IV generator; a value encrypted under a different algorithm, or without an IV generator, cannot be decrypted at runtime:

jbang org.apache.camel:camel-jasypt:<camel-version> \
  -c encrypt -p "$JASYPT_PASSWORD" -i my-secret-value \
  -a PBEWITHHMACSHA256ANDAES_256 -riga SHA1PRNG
The camel-jasypt CLI entrypoint is deprecated. The encrypt.sh script shipped in the Jasypt distribution provides the same workflow, and takes the algorithm and IV generator through its own algorithm and ivGeneratorClassName arguments.

To keep reading values that were encrypted with the previous default algorithm, pin it explicitly:

camel.component.jasypt.algorithm = PBEWithMD5AndDES

Spring Boot Auto-Configuration

The starter supports 9 options, which are listed below.

Name Description Default Type

camel.component.jasypt.algorithm

The algorithm to be used for decryption. Default: PBEWITHHMACSHA256ANDAES_256. This algorithm requires an initialization vector, which is generated automatically unless ivGeneratorClassName is set explicitly. Values encrypted with a different algorithm can only be decrypted by setting this option to that algorithm, for example PBEWithMD5AndDES.

PBEWITHHMACSHA256ANDAES_256

String

camel.component.jasypt.early-decryption-enabled

Enable the early properties decryption during Spring Start Up. Enabling this feature, encrypted properties can be decrypted before the Spring Boot AutoConfiguration kicks in, for example, server.port=ENC(oBpQDDUvFY0c4WNAG0o4LIS5bWqmlxYlUUDTW2iXJIAZFYvM+3vOredaMcVfL4xW) will be decrypted to 8082, and the application will start using that port.

false

Boolean

camel.component.jasypt.enabled

Enable the component

false

Boolean

camel.component.jasypt.iv-generator-class-name

The initialization vector (IV) generator applied in decryption operations. Default: org.jasypt.iv.

String

camel.component.jasypt.password

The master password used by Jasypt for decrypting the values. This option supports prefixes which influence the master password lookup behaviour: sysenv: means to lookup the OS system environment with the given key. sys: means to lookup a JVM system property. The master password should be supplied through one of those prefixes, or from an external secret store, and should not be stored alongside the encrypted values it protects.

String

camel.component.jasypt.provider-name

The class name of the security provider to be used for obtaining the encryption algorithm.

String

camel.component.jasypt.random-iv-generator-algorithm

The algorithm for the random iv generator

SHA1PRNG

String

camel.component.jasypt.random-salt-generator-algorithm

The algorithm for the salt generator

SHA1PRNG

String

camel.component.jasypt.salt-generator-class-name

The salt generator applied in decryption operations. Default: org.jasypt.salt.RandomSaltGenerator

org.jasypt.salt.RandomSaltGenerator

String
Back to top