Configuring Network Client authentication without SSL/TLS

If you do not encrypt network traffic with SSL/TLS, you can use properties to specify the encryption of user names and passwords on the client side.

Important: Using SSL/TLS is strongly recommended for production applications. Use the properties only under unusual circumstances.

The securityMechanism=value property specifies a security mechanism for the Derby Network Client. See the Derby Reference Manual for details on this property.

You can set the securityMechanism property in one of the following ways:

When you are using the java.sql.DriverManager class, set securityMechanism=value in a java.util.Properties object before you invoke the form of the DriverManager.getConnection method that includes the java.util.Properties parameter.
When you are using the ClientDataSource interface to create and deploy your own DataSource objects, invoke the ClientDataSource.setSecurityMechanism method after you create a ClientDataSource object.

The following table lists the security mechanisms that the Derby Network Client supports, and the corresponding property value to specify to obtain this security mechanism. The default security mechanism is the user id only if no password is set. If the password is set, the default security mechanism is both the user id and password. The default user is APP if no other user is specified.

Table 1. Security mechanisms supported by the Derby Network Client
Security Mechanism	securityMechanism Property Value	Comments
User id and password	`ClientDataSource.CLEAR_TEXT_PASSWORD_SECURITY` (0x03)	Default if password is set
User id only	`ClientDataSource.USER_ONLY_SECURITY` (0x04)	Default if password is not set
Encrypted user id and encrypted password	`ClientDataSource.ENCRYPTED_USER_AND_PASSWORD_SECURITY` (0x09)	Encryption requires a JCE implementation that supports the Diffie-Hellman algorithm with a public prime of 256 bits.

Derby provides two ClientDataSource implementations. Use the org.apache.derby.jdbc.ClientDataSource class on all supported Java SE versions except Java SE 8 Compact Profile 2. On Java SE 8 Compact Profile 2, use the org.apache.derby.jdbc.BasicClientDataSource40 class.