There are multiple parts to this
(1) If the security-domain is defined for a datasource and the password is invalid, an error is reported in the console which is expected
<datasource jndi-name="java:/DefaultDS2" pool-name="DefaultDS2" enabled="true" use-java-context="true">
<connection-url>jdbc:oracle:thin:@hostname:1521:ora1</connection-url>
<driver>oracle</driver>
<security>
<security-domain>encryptedPassword2</security-domain>
</security>
</datasource>
(2) If the 'password' for the datasource is invalid no error is reported in the console log at startup e.g
<datasource jndi-name="java:/DefaultDS2" pool-name="DefaultDS2" enabled="true" use-java-context="true">
<connection-url>jdbc:oracle:thin:@hostname:1521:ora1</connection-url>
<driver>oracle</driver>
<security>
<user-name>user</user-name>
<password>passwd</password>
</security>
</datasource>
3. Whether or not you use a security-domain for a datasource, an invalid 'username' doesn't get flagged in the console.
Actual results:
Expected results:
Invalid username and password should be flagged as login errors in the console log.
It shouldn't make a difference whether or not you use security-credentials