Setting up JBoss6 Security

for the MemberzPlus installer

In prior releases of MemberzPlus, there has been no need to do anything special to enable strong encryption other than installing the unlimited key policy jar files. As of Version 6 of JBoss, the security model has changed. Now we have to install the Java Cryptography Extension (JCE) provider at the JDK level. In other words, it has to be installed in the Java system, rather than in the JBoss application.

MemberzPlus uses the Bouncy Castle JCE provider. This is a popular choice due to the fact that it is open source and has a huge customer base. Free is good. In previous versions of MemberzPlus, we just put the Bouncy Castle jar files in the /lib/ext folder in JBoss and everything worked fine. Now we need to put them in the Java environment:

1) Copy the Bouncy Castle jars (bcprov-jdk16-144.jar, bcpg-jdk16-144.jar) to {java home}/jre/lib/ext.

2) Update the {java home}/jre/lib/security/java.security file to add the Bouncy Castle Provider by adding this to the list of providers:

security.provider.9=org.bouncycastle.jce.provider.BouncyCastleProvider