Einleitung

The credential store provides a way to use passwords without exposing these to developers.

The server administrator is responsible for setting up the credential store and filling it with passwords. The server administrator should provide a list of available credentials to developers. These developers can use the identifier of a password.

There are two available ways to store passwords:

• a json file on disk;
• in the Azure Key Vault.

📘

Hinweis

You can only use one of the methods simultaneously.

Voraussetzungen

An Azure environment should be available for Azure Key Vault.

Setting up a file-based credential store

The file-based credential store is a json file that resides on disk, called credential_store.json. This file must contain a single object, containing a set of key-value pairs, where:

• key is the identifier that developers should use,
• value contains the actual password.

Follow these steps to create a file-based credential store containing one password, with PasswordIdentifer as an identifier.

The identifier PasswordIdentifier can now be used by developers and, when used, will result in the password s3cr3tp4ssw0rd.

Below is an example of a credential_store.json file for a credential store with multiple passwords.

{
      "passwordIdentifier": "secr3tp4ssw0rd"
    , "ldapServerPassword": "BBx^W2Vh(7!r_>!%"
    , "oracleDatabasePassword": "~5u4$8HtCE>3mXpV"
    , ...
}

Setting up an encrypted file-based credential store

Überdies besteht die Möglichkeit, einen verschlüsselten, dateibasierten Anmeldeinformationsspeicher zu erstellen. In diesem Fall legen Sie den Typ auf Encrypted im CredentialStore-Eintrag in den Servereinstellungen fest. Es ist nur möglich, Einträge im verschlüsselten Anmeldeinformationsspeicher mit dem DataServer-Befehl -AddEncryptedPasswordhinzuzufügen.

-dataserver -AddEncryptedPassword <key> <password>

Follow these steps to create an encrypted file-based credential store containing one password, with PasswordIdentifer as an identifier.

Added password entries cannot be removed.

📘

Hinweis

The -AddEncryptedPassword command will overwrite existing password values without notification.