I need advice on this simple strategy question: I have a typical User entity which among other fields, has a <String> password. When I update the user object I do not want to update the password because it is encrypted in the database and the user object that I am updating, that has been passed in from the UI, contains the unencrypted password that the user has entered (which i use to validate the user performing the update.)

What is the best way to make the password only get inserted when creating a new user, but never updated. Should PASSWORD be an embedded component? Does it have to be a ONE-TO-ONE association with a specific cascade type set? Should PASSWORD be an entity itself and exist in a separate table?

What is the simplest and best practices way to handle this?

PS: I could simply reset the password with the database value each time prior to merging the User object, but that does not feel like the most elegant way.

Thanks
John

There are two ways to solve this problem related to context -

First - If you want to set password property as immutable (then you can't change password form User entity).

Map password property as update=false, so this property value will never will appear in Update statement of User.
Like




If your are use JPA then
@Column(name="PASSWORD",updatable="false")


Second- If you want to update password property whenever your change it. (Means password should be only be come in update statement, if you change the value of it).

Map the User class using dynamic-update="true". Then password column appear in the update statement of user table only when you change the value of password property of user class. If you set dynamic-update="true" in a class, Hibernate at run time find out what properties has change and then only changed property will appear in update statement.