Verwenden Sie Anmeldeinformationsassets für Verbindungen

Instead of entering values directly when creating connections, you can reference Orchestrator assets. For secret fields such as passwords, API keys, and client secrets, Integration Service resolves a Credential asset through Orchestrator from a linked external vault and never stores the value in the Integration Service database. For other fields, the value is read from a standard Orchestrator Text, Bool, or Integer asset.

This feature is designed for organizations with centralized configuration management requirements, or with strict security and compliance policies around credential handling.

Wie es funktioniert

Credential assets (secret fields)

When a connection uses a Credential asset, Integration Service calls Orchestrator, which retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If the credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Text, Bool, and Integer assets (other fields)

When a connection uses a Text, Bool, or Integer asset, Integration Service reads the value from Orchestrator. No external vault is involved.

Hinweis:

The asset types shown in the picker depend on the field. Secret fields such as Password, API Key, and Client Secret show only Credential assets. Other supported fields show Text, Bool, and Integer assets. Drop-down fields do not show the picker. OAuth 2.0 access and refresh tokens are still stored in Integration Service after the initial authorization flow, because the OAuth protocol requires more than a client secret to authenticate. You can use a credential asset for the client secret field in BYOA (Bring your own OAuth 2.0 app) authentication types, but not for the resulting OAuth tokens.

Voraussetzungen

• Integration Service ist aktiviert und für Ihren Mandanten bereitgestellt.
• If using Credential assets for secret fields: at least one credential store is configured in Orchestrator. Supported external vaults include CyberArk, HashiCorp Vault, and all others supported by Orchestrator's credential store integrations.
• One or more Orchestrator assets are available in the folder where the connection is created. The asset type depends on the field — secret fields such as Password, API Key, and Client Secret require a Credential asset; other fields accept a Text, Bool, or Integer asset.

Step 1: Configure the credential store in Orchestrator (Credential assets only)

If you plan to use Credential assets for secret fields, set up a credential store in Orchestrator that connects to your external vault. Skip this step if you only need Text, Bool, or Integer assets.

Anweisungen finden Sie unter Über Anmeldeinformationsspeicher im Orchestrator-Benutzerhandbuch.

Step 2: Create an asset in Orchestrator

In an Orchestrator folder, create the asset that matches the field type you want to supply:

• For secret fields: create an asset of type Credential and link it to the secret in the credential store.
• For other fields: create a Text, Bool, or Integer asset and enter the value directly.

Anweisungen finden Sie unter Verwalten von Assets in Orchestrator im Orchestrator-Benutzerhandbuch.

Schritt 3: Verweisen Sie beim Erstellen einer Verbindung auf das Anmeldeinformations-Asset

1. Wählen Sie in Orchestrator einen Ordner aus und navigieren Sie zur Registerkarte Verbindungen .

2. Wählen Sie Verbindung hinzufügen und dann den Connector.

3. On the connection creation page, locate a supported field. Secret fields (Password, API Key, Client Secret) and plain text fields (such as Client ID or Token URL) both support Orchestrator assets.

4. Select the menu icon next to the field and select Use credential asset (for secret fields) or Use Orchestrator asset (for other fields).

   

5. Select the asset you want to use. You can select assets that are either found in the folder where you are creating the connection or shared with the folder using asset links.

6. Füllen Sie alle verbleibenden Felder aus und wählen Sie Verbinden aus.

Häufig gestellte Fragen

Are Credential asset values fetched from the vault on every request?

No. When a Credential asset is used, its value is cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured. Text, Bool, and Integer asset values are read from Orchestrator on each use and are not cached.

What happens when a Credential asset is rotated before the cache expires?

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step. This applies to Credential assets only.

Are asset values stored in Integration Service?

For Credential assets: no. Values are not written to the Integration Service database and are held in memory in an encrypted state for the one-hour cache duration only. For Text, Bool, and Integer assets: values are read from Orchestrator at the time the connection is used and are not persisted in Integration Service.

Funktioniert dies für alle Connectors?

Yes. This feature works with all connectors, regardless of authentication type.

Gilt dies für alle Felder im Verbindungsformular?

Dropdown fields are not supported — the picker does not appear on them. On all other fields, the picker shows only the asset types compatible with that field. Secret fields such as Password and API Key show only Credential assets; other fields show Text, Bool, and Integer assets.

Welche Typen von Orchestrator-Assets werden unterstützt?

The asset types available depend on the field type:

Feld	Available asset types
Secret fields (Password, API Key, Client Secret)	Anmeldeinformationen
Other fields	Text, Bool, Integer

Welche externen Tresore werden unterstützt?

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores. External vaults apply to Credential assets only — Text, Bool, and Integer assets store their values directly in Orchestrator.

Wird Proxy unterstützt?

Ja. Es werden sowohl verbundene als auch getrennte Proxy-Konfigurationen unterstützt.

Kann ich ein Anmeldeinformations-Asset für OAuth-Token verwenden?

Nein. OAuth 2.0-Zugriffs- und Aktualisierungstoken werden nach dem ersten Autorisierungsablauf immer im Integration Service gespeichert. Nur Eingabefelder vom Typ Geheimnis auf dem Verbindungsbildschirm (z. B. Clientgeheimnis in der BYOM-Authentifizierung) können auf ein Anmeldeinformations-Asset verweisen.