コネクションに資格情報アセットを使用する

Instead of entering values directly when creating connections, you can reference Orchestrator assets. For secret fields such as passwords, API keys, and client secrets, Integration Service resolves a Credential asset through Orchestrator from a linked external vault and never stores the value in the Integration Service database. For other fields, the value is read from a standard Orchestrator Text, Bool, or Integer asset.

This feature is designed for organizations with centralized configuration management requirements, or with strict security and compliance policies around credential handling.

動作のしくみ

Credential assets (secret fields)

When a connection uses a Credential asset, Integration Service calls Orchestrator, which retrieves the secret from the linked external vault. The resolved value is cached in memory (encrypted) for one hour to reduce repeated vault API calls.

If the credential becomes invalid before the cache expires — for example, because it was rotated — Integration Service automatically fetches a fresh value from the vault and retries the failed step. All communication between Integration Service and Orchestrator or the external vault is encrypted using HTTPS/TLS.

Text, Bool, and Integer assets (other fields)

When a connection uses a Text, Bool, or Integer asset, Integration Service reads the value from Orchestrator. No external vault is involved.

注:

The asset types shown in the picker depend on the field. Secret fields such as Password, API Key, and Client Secret show only Credential assets. Other supported fields show Text, Bool, and Integer assets. Drop-down fields do not show the picker. OAuth 2.0 access and refresh tokens are still stored in Integration Service after the initial authorization flow, because the OAuth protocol requires more than a client secret to authenticate. You can use a credential asset for the client secret field in BYOA (Bring your own OAuth 2.0 app) authentication types, but not for the resulting OAuth tokens.

前提条件

• Integration Service はテナントに対して有効化され、プロビジョニングされている。
• If using Credential assets for secret fields: at least one credential store is configured in Orchestrator. Supported external vaults include CyberArk, HashiCorp Vault, and all others supported by Orchestrator's credential store integrations.
• One or more Orchestrator assets are available in the folder where the connection is created. The asset type depends on the field — secret fields such as Password, API Key, and Client Secret require a Credential asset; other fields accept a Text, Bool, or Integer asset.

Step 1: Configure the credential store in Orchestrator (Credential assets only)

If you plan to use Credential assets for secret fields, set up a credential store in Orchestrator that connects to your external vault. Skip this step if you only need Text, Bool, or Integer assets.

手順については、『Orchestrator ガイド』の「 資格情報ストアについて 」をご覧ください。

Step 2: Create an asset in Orchestrator

In an Orchestrator folder, create the asset that matches the field type you want to supply:

• For secret fields: create an asset of type Credential and link it to the secret in the credential store.
• For other fields: create a Text, Bool, or Integer asset and enter the value directly.

手順については、『Orchestrator ガイド』の「 Orchestrator でアセットを管理する 」をご覧ください。

手順 3: コネクションの作成時に資格情報アセットを参照する

1. Orchestrator でフォルダーを選択して [ コネクション ] タブに移動します。

2. [ コネクションを追加 ] を選択して、コネクタを選択します。

3. On the connection creation page, locate a supported field. Secret fields (Password, API Key, Client Secret) and plain text fields (such as Client ID or Token URL) both support Orchestrator assets.

4. Select the menu icon next to the field and select Use credential asset (for secret fields) or Use Orchestrator asset (for other fields).

   

5. Select the asset you want to use. You can select assets that are either found in the folder where you are creating the connection or shared with the folder using asset links.

6. 残りのフィールドに入力し、[ 接続] を選択します。

よくある質問

Are Credential asset values fetched from the vault on every request?

No. When a Credential asset is used, its value is cached in memory (encrypted) for one hour to reduce repeated vault API calls and improve runtime efficiency. The cache duration cannot be configured. Text, Bool, and Integer asset values are read from Orchestrator on each use and are not cached.

What happens when a Credential asset is rotated before the cache expires?

If a request fails because the cached credential has become invalid, Integration Service automatically fetches a fresh value from the vault and retries the failed step. This applies to Credential assets only.

Are asset values stored in Integration Service?

For Credential assets: no. Values are not written to the Integration Service database and are held in memory in an encrypted state for the one-hour cache duration only. For Text, Bool, and Integer assets: values are read from Orchestrator at the time the connection is used and are not persisted in Integration Service.

これはすべてのコネクタで機能しますか?

Yes. This feature works with all connectors, regardless of authentication type.

これはコネクション フォームのすべてのフィールドに適用されますか?

Dropdown fields are not supported — the picker does not appear on them. On all other fields, the picker shows only the asset types compatible with that field. Secret fields such as Password and API Key show only Credential assets; other fields show Text, Bool, and Integer assets.

どの種類の Orchestrator アセットがサポートされていますか?

The asset types available depend on the field type:

フィールド	Available asset types
Secret fields (Password, API Key, Client Secret)	Credential
Other fields	Text, Bool, Integer

どの外部コンテナーがサポートされていますか?

All credential store types supported by Orchestrator are supported. For the full list, see About credential stores. External vaults apply to Credential assets only — Text, Bool, and Integer assets store their values directly in Orchestrator.

プロキシはサポートされていますか?

はい。接続状態のプロキシ構成と非接続のプロキシ構成の両方がサポートされています。

OAuth トークンに資格情報アセットを使用できますか?

いいえ。OAuth 2.0 のアクセス トークンと更新トークンは、最初の承認フローの後、常に Integration Service に保存されます。資格情報アセットを参照できるのは、接続画面の [シークレット] タイプの入力フィールド (BYOA 認証の [クライアント シークレット ] など) のみです。