USER MANUALS

Credentials Vault Support in the Denodo Platform

The Denodo Platform and Solution Manager provide support to obtain the credentials from an external Credentials Vault. That is, instead of entering in Denodo the user and password of a service account, you enter the name of the “secret” in the password vault. At runtime, the username and password is retrieved from this vault.

The main benefits to using a credentials vault are:

  • The developers/administrators of Denodo do not need to know the username/password of the service accounts of the databases.

  • The security team of your organization can now configure the vault to rotate the password of the service accounts Denodo uses. This enables you to replace long-term passwords with short-term ones, which reduces the risk of compromise. Without the vault, changing the password of the service accounts involves coordinating the database administrators and the administrators of Virtual DataPort to do the change at the same time.

  • It allows the security team of your organization to keep a trail of what applications use each service account.

Supported Vault Providers

Supported vault providers:

  • AWS Secrets Manager

  • Azure Key Vault

  • CyberArk

  • HashiCorp

Features that Use a Credentials Vault

Denodo - as of update 9.5 - supports obtaining the credentials from a vault in these modules:

  • In Virtual DataPort, to obtain the credentials to connect to:

    • Databases. That is, 1) as a data source, 2) to the materialization database (pka cache), and 3) to the metadata database.

    • SAP (in BAPI data sources).

    • MongoDB

  • In the other modules, to obtain the credentials to connect to the metadata database. This is for Data Marketplace, Diagnostic & Monitoring Tool, Scheduler and Solution Manager.

Initial Common Configuration Step

Before enabling the features listed above, you have to set up the connection to the credentials vault of your organization. After that, you can enable the use of the credentials vault in each feature of Virtual DataPort, Solution Manager, …

There are two alternative ways of doing so:

  1. With a configuration file: create the file <DENODO_HOME>/conf/metadata-configuration-vault.yaml. In it, you put the connection settings. They are different depending on the vault.

  2. Or, defining environment variables. This is specially useful when you deploy the Denodo Platform on a container / Kubernetes deployment because you avoid having to create local files.

The subsections below have templates to create this .yaml file, and the environment variables, to set the connection up. They are different depending on the vault your organization uses.

After that, all the modules of Denodo Platform/Solution Manager will read the .yaml file or the environment variables. This eliminates the need to repeat the same configuration steps for each module.

Important

You either set up this connection with a .yaml file or with environment variables. You cannot do it both ways.

Note

After creating or changing this file, or after defining an environment variable, you must restart each affected module so it picks up the changes.

Note

For several providers, in the .yaml file, you are going to enter the property password, or an environment variable whose name ends with PASSWORD. Their value can store a password in plain text or encrypted. To encrypt it, execute <DENODO_HOME>/bin/encrypt_password of the installation. Then, copy the output of this script and prefix the value with encrypted:. E.g. encrypted:+72p/O7m0JCpr...

The goal is to prevent this password to be stored in cleartext in scripts or other systems.

AWS Secrets Manager

This section explains how to configure the connection to AWS Secrets Manager.

Template file for AWS Secrets Manager

vault:
  enabled: true
  provider: aws
  config:
    region: "<AWS REGION OF YOUR VAULT INSTANCE>"
  auth:
    method: "<AUTHENTICATION METHOD; SEE BELOW THE POSSIBLE VALUES>"
    parameters:
      <THE PARAMETERS DEPEND ON THE VALUE OF "method">

method is the authentication method used to connect to AWS Secrets Manager. Enter one of these values:

  1. basic: for this authentication method, add these subfields to the block parameters:

    • access_key

    • secret_key

  2. standard: does not need any field in parameters. It uses the standard mechanism of AWS to obtain credentials.

Environment variables for AWS Secrets Manager

Instead of creating a .yaml file, you can define environment variables. These are the variables:

DENODO_VAULT_ENABLED

Set the value to true

DENODO_VAULT_PROVIDER

Set the value to aws

DENODO_VAULT_AWS_REGION

The AWS region

DENODO_VAULT_PLUGIN

For basic authentication

set the value to awsSecretsManagerBasic. For standard

awsSecretsManagerStandard

DENODO_VAULT_AWS_ACCESS_KEY

The access key

DENODO_VAULT_AWS_SECRET_KEY

The secret key

Examples

Sample configuration file to connect to AWS Secrets Manager: Basic authentication
vault:
  enabled: true
  provider: "aws"
  config:
    region: "eu-west-1"
  auth:
    method: "basic"
    parameters:
      access_key: "DFAADDQER466DJKDP"
      secret_key: "2mQTx6jFma4Taj/AxS3BTa"
Sample environment variables to connect to AWS Secrets Manager: Basic authentication
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=aws
DENODO_VAULT_PLUGIN=awsSecretsManagerBasic
DENODO_VAULT_AWS_REGION=eu-west-1
DENODO_VAULT_AWS_ACCESS_KEY=DFAADDQER466DJKDP
DENODO_VAULT_AWS_SECRET_KEY=2mQTx6jFma4Taj/AxS3BTa
Sample configuration file to connect to AWS Secrets Manager: Standard authentication
vault:
  enabled: true
  provider: "aws"
  config:
    region: "eu-west-1"
  auth:
    method: "standard"
Sample environment variables to connect to AWS Secrets Manager: Standard authentication
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=aws
DENODO_VAULT_PLUGIN=awsSecretsManagerStandard
DENODO_VAULT_AWS_REGION=eu-west-1
AWS_ACCESS_KEY_ID=DFAADDQER466DJKDP
AWS_SECRET_ACCESS_KEY=2mQTx6jFma4Taj/AxS3BTa

Azure Key Vault

This section explains how to configure the connection to Azure Key Vault.

Template file for Azure Key Vault

vault:
  enabled: true
  provider: "azurekeyvault"
  config:
    vault_uri: "https://<VAULT NAME>.vault.azure.net/"
  auth:
    method: "<AUTHENTICATION METHOD; SEE BELOW THE POSSIBLE VALUES>"
    parameters:
      <THE PARAMETERS DEPEND ON THE "method">

method is the authentication method used to connect to Azure Key Vault. Enter one of these values:

  1. client_secret: for this authentication method, add these subfields to the block parameters:

    • tenant_id (mandatory)

    • client_id (mandatory)

    • secret_key (mandatory)

  2. client_certificate: for this authentication method, add these subfields to the block parameters:

    • tenant_id (mandatory)

    • client_id (mandatory)

    • type: the value can be PEM or PFX_P12 (predeterminado: PEM)

    • certificate_resource (mandatory)

    • certificate_password (Opcional según formato)

  3. user_managed: for this authentication method, add this subfield to the block parameters:

    • client_id Mandatory

  4. system_managed: does not require parameters.

  5. environment: does not require parameters.

Environment variables for Azure Key Vault

Instead of creating a .yaml file, you can define environment variables. These are the variables:

DENODO_VAULT_ENABLED

Set the value to true

DENODO_VAULT_PROVIDER

Set the value to azurekeyvault

DENODO_VAULT_AZURE_VAULT_URI

DENODO_VAULT_AZURE_TENANT_ID

DENODO_VAULT_AZURE_CLIENT_ID

DENODO_VAULT_AZURE_SECRET_KEY
Environment variables to define the certificate information

DENODO_VAULT_AZURE_CERT_RESOURCE

DENODO_VAULT_AZURE_CERT_TYPE

DENODO_VAULT_AZURE_CERT_PASSWORD

Examples

Sample configuration file to connect to Azure Key Vault - Client certificate
vault:
  enabled: true
  provider: "azurekeyvault"
  config:
    vault_uri: "https://acme-key-vault.vault.azure.net/"
  auth:
    method: client_certificate
    parameters:
      tenant_id: "5684j24e-7780-4f14-bcbc"
      client_id: "1c5h04cd-109a-4d48-ba9a"
      type: "PEM"
      certificate_resource: "C:/Denodo/external_resources/denodo_key_vault.pem"
Sample configuration file to connect to Azure Key Vault - System Managed
vault:
  enabled: true
  provider: "cyberark"
  config:
    url: "https://denodo-key-vault.vault.azure.net/"
  auth:
    method: "system_managed"

CyberArk

This section explains how to configure the connection to CyberArk.

Template file for CyberArk

vault:
  enabled: true
  provider: "cyberark"
  config:
    url: "https://<URL of your CyberArk server>/<CyberArk service>/api/Accounts/"
  auth:
    method: "<AUTHENTICATION METHOD; SEE BELOW THE POSSIBLE VALUES>"
    parameters:
      <THE PARAMETERS DEPEND ON THE "method">

method is the authentication method used to connect to CyberArk. Enter one of these values:

  1. agent: for this authentication method, add this subfield to the block parameters:

    • application_id. Mandatory

  2. agentless: for this authentication method, add these subfields to the block parameters:

    • application_id. Mandatory

    • client_auth_resource. Mandatory

    • client_auth_password. Mandatory

    • trust_store_resource. Optional

    • trust_store_password. Optional

Environment variables for CyberArk

Instead of creating a .yaml file, you can define environment variables. These are the variables:

DENODO_VAULT_ENABLED

Set the value to true

DENODO_VAULT_PROVIDER

Set the value to cyberark

DENODO_VAULT_PLUGIN

Allowed values: cyberArkAgentLess

cyberArkAgent

DENODO_VAULT_CYBERARK_URL

DENODO_VAULT_CYBERARK_APP_ID

DENODO_VAULT_CYBERARK_CLIENT_AUTH

DENODO_VAULT_CYBERARK_CLIENT_AUTH_PASSWORD

Examples

Sample configuration file to connect to CyberArk - Agentless
vault:
  enabled: true
  provider: cyberark
  config:
    url: "https://cyberark_server.acme.com/AIMWebService/api/Accounts"
  auth:
    method: agentless
    parameters:
      application_id: "Denodocert"
      client_auth_resource: "file:/C:/Denodo/external_resources/cyberark_private_key.p12"
      client_auth_password: "<PASSWORD for the .P12 file>"
      trust_store_resource: "file:/C:/Denodo/external_resources/cyberark_truststore.crt"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to CyberArk - Agentless
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=cyberark
DENODO_VAULT_PLUGIN=cyberArkAgentLess
DENODO_VAULT_CYBERARK_URL=https://cyberark_server.acme.com/AIMWebService/api/Accounts
DENODO_VAULT_CYBERARK_APP_ID=Denodocert
DENODO_VAULT_CYBERARK_CLIENT_AUTH=file:/C:/Denodo/external_resources/cyberark_private_key.p12
DENODO_VAULT_CYBERARK_CLIENT_AUTH_PASSWORD=<PASSWORD for the .P12 file>
DENODO_VAULT_CYBERARK_TRUST_STORE=file:/C:/Denodo/external_resources/cyberark_truststore.crt
Sample configuration file to connect to CyberArk - Agent
vault:
  enabled: true
  provider: cyberark
  auth:
    method: agent
    parameters:
      application_id: "Denodocert"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to CyberArk - Agent
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=cyberark
DENODO_VAULT_PLUGIN=cyberArkAgent
DENODO_VAULT_CYBERARK_APP_ID=Denodotest

HashiCorp

This section explains how to configure the connection to HashiCorp Vault. You can use any of the following authentication methods:

  • Agent. Connects to HashiCorp using a sink file.

  • App Role. Connects to HashiCorp using “AppRole” authentication.

  • LDAP. Connects to HashiCorp using a LDAP user.

  • TLS Certificate. Connects to HashiCorp using TLS client certificates.

  • Token. Connects to HashiCorp using a token.

  • User/password. Connects to HashiCorp using user and password.

Template File for HashiCorp

vault:
  enabled: true
  provider: hashicorp
  config:
    vault_uri: "https://<URL of the HashiCorp server>/"

    # Optional parameter
    namespace: "<NAMESPACE>"

    # Optional parameter
    wrap_responses: <ENTER true OR false>

    # Optional parameter
    wrap_seconds: <AN INTEGER NUMBER>

    # Optional parameter
    tls:
      trust_store_path: "<PATH TO THE TRUST STORE>

      # Optional parameter; you can add "trust_store_path" without indicating "trust_store_password"
      trust_store_password: "<TRUST STORE PASSWORD>"
   auth:
      method: "<AUTHENTICATION METHOD; SEE BELOW THE POSSIBLE VALUES>"
      parameters:
         <THE PARAMETERS DEPEND ON THE "method">

Environment variables for HashiCorp

Instead of creating a .yaml file, you can define environment variables. These are the variables:

Environment Variables Common to All the Authentication Methods

DENODO_VAULT_ENABLED

true (set the variable to this value)

DENODO_VAULT_PROVIDER

hashicorp (set the variable to this value)

DENODO_VAULT_HASHICORP_URL

URL of the HashiCorp Vault. E.g. “https://hashicorp-host:8200”.

DENODO_VAULT_HASHICORP_NAMESPACE

Namespace used in HashiCorp to get the credentials. E.g. “namespace_denodo_service_credentials”

DENODO_VAULT_HASHICORP_TRUST_STORE_PATH

DENODO_VAULT_HASHICORP_TRUST_STORE_PASSWORD

DENODO_VAULT_HASHICORP_WRAP_RESPONSES

DENODO_VAULT_HASHICORP_WRAP_SECONDS

HashiCorp - Agent

To connect to HashiCorp with the authentication method Agent, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “AppRole”
vault:
  enabled: true
  ...
  ...
  ...
  method: "agent"
  parameters:

    # Path to the file where the HashiCorp Agent generates the credentials.
    sink_file: "<value>"

Environment variables for HashiCorp - Agent

Additional environment variables you have to define for Agent:

DENODO_VAULT_PLUGIN

Set to hashicorpAgent

HashiCorp - AppRole

To connect to HashiCorp with the authentication method AppRole, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “AppRole”
vault:
  enabled: true
  ...
  ...
  ...
  method: "approle"
  parameters:

    # Role identifier of an existing App Role
    role_id: "<value>"

    # Secret identifier attached to an existing App Role
    secret_id: "<value>"

Environment variables for HashiCorp - AppRole

Additional environment variables you have to define for AppRole:

DENODO_VAULT_PLUGIN

Set to hashicorpAppRole

DENODO_VAULT_HASHICORP_APPROLE_ROLE_ID

DENODO_VAULT_HASHICORP_APPROLE_SECRET_ID

Example

Sample configuration file to connect to HashiCorp with AppRole
vault:
  enabled: true
  provider: "hashicorp"
  config:
    address: "https://hashicorp.acme.com:8200"
    namespace: "denodo_ns"
    wrap_responses: false
    wrap_seconds: 20
    tls:
      trust_store_path: "file:/C:/Denodo/external_resources/hashicorp.cer"
  auth:
    method: "approle"
    auth_path: "custom-approle"
    parameters:
      role_id: "denodo_role_noexpire_denodo_ns"
      secret_id: "encrypted:5bFcsKpn5pWX3HgpkB3MyTAeCs13CPbVXt5K5NS/q0LBwdPBJDp+ofuMv/S2qpMs/saNBw5fbgdYEW61xHGyGIZqO3tc1KBCyOiOI0Q+qTd4PZeaKnFji342yY0Sr5mB"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with AppRole
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashicorp
DENODO_VAULT_PLUGIN=hashicorpAppRole
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200
DENODO_VAULT_HASHICORP_NAMESPACE=denodo_ns
DENODO_VAULT_HASHICORP_WRAP_RESPONSES=false
DENODO_VAULT_HASHICORP_WRAP_SECONDS=20
DENODO_VAULT_HASHICORP_TRUST_STORE=file:/C:/Denodo/external_resources/hashicorp.cer
DENODO_VAULT_HASHICORP_AUTH_PATH=custom-approle
DENODO_VAULT_HASHICORP_APPROLE_ROLE_ID=denodo_role_noexpire_denodo_ns
DENODO_VAULT_HASHICORP_APPROLE_SECRET_ID=encrypted:5bFcsKpn5pWX3HgpkB3MyTAeCs13CPbVXt5K5NS/q0LBwdPBJDp+ofuMv/S2qpMs/saNBw5fbgdYEW61xHGyGIZqO3tc1KBCyOiOI0Q+qTd4PZeaKnFji342yY0Sr5mB

HashiCorp - LDAP

To connect to HashiCorp with the authentication method LDAP, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “LDAP”
vault:
  enabled: true
  ...
  ...
  ...
  method: "ldap"
  parameters:

    # Both fields are mandatory
    username: <value>
    password: <value>

Environment variables for HashiCorp - LDAP

Additional environment variables you have to define for LDAP:

DENODO_VAULT_PLUGIN

Set to hashicorpLdap

DENODO_VAULT_HASHICORP_USER

DENODO_VAULT_HASHICORP_PASSWORD

Example

Sample configuration file to connect to HashiCorp with LDAP
vault:
  enabled: true
  provider: hashiCorp
  config:
    address: https://hashicorp.acme.com:8200
    wrap_responses: false
    wrap_seconds: 20
  auth:
    method: ldap
    parameters:
      username: denodo_service_account
      password: encrypted:+72p/O7m0JCpr8krCvQh61ZJZhRBreB6a9P7nPc7Y4YpxewNNmzcJZO3QN9fUKs7iBDypOenBiHn71oRH4C56tYTuXcJzubD+x1PZEs7l42c32HKbg9l2iJFPhcEB1xtaDjJC25uyHfRxwJWAManrA==

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with LDAP
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashicorp
DENODO_VAULT_PLUGIN=hashicorpLDAP
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200
DENODO_VAULT_HASHICORP_WRAP_RESPONSES=false
DENODO_VAULT_HASHICORP_WRAP_SECONDS=20
DENODO_VAULT_HASHICORP_LDAP_USER=denodo_service_account
DENODO_VAULT_HASHICORP_LDAP_PASSWORD=encrypted:+72p/O7m0JCpr8krCvQh61ZJZhRBreB6a9P7nPc7Y4YpxewNNmzcJZO3QN9fUKs7iBDypOenBiHn71oRH4C56tYTuXcJzubD+x1PZEs7l42c32HKbg9l2iJFPhcEB1xtaDjJC25uyHfRxwJWAManrA==

HashiCorp - TLS Certificate

To connect to HashiCorp with the authentication method TLS Certificate, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “TLS Certificate”
vault:
  enabled: true
  ...
  ...
  ...
  method: "tls"
  parameters:

    # Name of role associated with this certificate (mandatory)
    certificate_name: "<value>"

    # Possible values: "PEM" or "PFX_P12"
    type: <value>

    # You need to add more fields, depending on the value of "type"

If type is PEM, add these subfields to the block parameters:

pem_key_path: "<Path to the PEM file that contains the private key. Mandatory>"
pem_cert_path: "<Path to the file. Mandatory>"
pem_chain_path: "<Optional>"

If type is PFX_P12, add these subfields to the block parameters:

pfx_path: "<Path to the PFX 12 file that contains the private key. Mandatory>"
pfx_password: "<Password of the PFX 12 file>

Environment variables for HashiCorp - TLS Certificate

Additional environment variables you have to define for TLS Certificate:

DENODO_VAULT_PLUGIN

Set to hashiCorpCertificate

DENODO_VAULT_HASHICORP_CLIENT_CERT_NAME

DENODO_VAULT_HASHICORP_CLIENT_CERT_TYPE

DENODO_VAULT_HASHICORP_CLIENT_CERT_URL

DENODO_VAULT_HASHICORP_PEM_KEY_URL

Examples

Example #1

Sample configuration file to connect to HashiCorp with TLS Certificate and a PEM certificate
vault:
  enabled: true
  provider: hashiCorp
  config:
    address: https://hashicorp.acme.com:8200
  auth:
    method: cert
    parameters:
      certificate_name: "name_of_your_certificate_in_the_vault"
      type: PEM
      pem_key_path: "file:/C:/Denodo/external_resources/hashicorp-client-key.pem"
      pem_cert_path: "file:/C:/Denodo/external_resources/hashicorp-client-cert.pem"
      # pem_chain_path: "file:/C:/Denodo/external_resources/hashicorp-chain.pem"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with TLS Certificate and a PEM certificate
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashiCorp
DENODO_VAULT_PLUGIN=hashiCorpCertificate
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200
DENODO_VAULT_HASHICORP_CLIENT_CERT_NAME=name_of_your_certificate_in_the_vault
DENODO_VAULT_HASHICORP_CLIENT_CERT_TYPE=PEM
DENODO_VAULT_HASHICORP_PEM_KEY_URL=file:/C:/Denodo/external_resources/hashicorp-client-key.pem
DENODO_VAULT_HASHICORP_PEM_CERT_URL=file:/C:/Denodo/external_resources/hashicorp-client-cert.pem
# DENODO_VAULT_HASHICORP_CLIENT_INTERMEDIATE_CERT=file:/C:/Denodo/external_resources/hashicorp-chain.pem

Example #2

Sample configuration file to connect to HashiCorp with TLS Certificate and a PFX/P12 certificate
vault:
  enabled: true
  provider: hashiCorp
  config:
    address: https://hashicorp.acme.com:8200
  auth:
    method: cert
    parameters:
      certificate_name: "name_of_your_certificate_in_the_vault"
      type: PFX_P12
      pfx_path: "file:/C:/Denodo/external_resources/hashicorp-key.pfx"
      pfx_password: "password_of_the_pfx_file"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with TLS Certificate and a PFX/P12 certificate
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashiCorp
DENODO_VAULT_PLUGIN=hashiCorpCertificate
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200

# Optional
# DENODO_VAULT_HASHICORP_AUTH_PATH=cert

DENODO_VAULT_HASHICORP_CLIENT_CERT_NAME=name_of_your_certificate_in_the_vault
DENODO_VAULT_HASHICORP_CLIENT_CERT_TYPE=PFX_P12
DENODO_VAULT_HASHICORP_CLIENT_CERT_URL=file:/C:/Denodo/external_resources/hashicorp-key.pfx
DENODO_VAULT_HASHICORP_CLIENT_CERT_PASSWORD=password_of_the_pfx_file

HashiCorp - Token

To connect to HashiCorp with the authentication method Token, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “Token”
vault:
  enabled: true
  ...
  ...
  ...
  method: "token"
  parameters:

    # IMPORTANT: Either define "token" or "env_var". Not both

    # Token used to connect to HashiCorp
    token: "<value>"

    # Environment variable name that at runtime, will hold the token to connect to HashiCorp
    env_var: "<value>"

Environment variables for HashiCorp - Token

Additional environment variables you have to define for Token:

DENODO_VAULT_PLUGIN

Set to hashicorpToken

DENODO_VAULT_HASHICORP_TOKEN

DENODO_VAULT_HASHICORP_TOKEN_ENV_VAR

Important

Only define one of these variables. Either DENODO_VAULT_HASHICORP_TOKEN, or DENODO_VAULT_HASHICORP_TOKEN_ENV_VAR.

Example

Sample configuration file to connect to HashiCorp with Token
vault:
  enabled: true
  provider: "hashicorp"
  config:
    address: "https://hashicorp.acme.com:8200"
    wrap_responses: false
    wrap_seconds: 20
    tls:
      trust_store_path: "file:/C:/Denodo/external_resources/hashicorp-vault.cer"
 auth:
   method: "token"
   parameters:
     token: "s.ix1sYUQreMps1VxFUaDfvT5n"

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with Token
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashicorp
DENODO_VAULT_PLUGIN=hashicorpToken
DENODO_VAULT_HASHICORP_WRAP_RESPONSES=false
DENODO_VAULT_HASHICORP_WRAP_SECONDS=20
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200
DENODO_VAULT_HASHICORP_TRUST_STORE=file:/C:/Denodo/external_resources/hashicorp-vault.cer
DENODO_VAULT_HASHICORP_TOKEN=s.ix1sYUQreMps1VxFUaDfvT5n

HashiCorp - User/password

To connect to HashiCorp with the authentication method User/password, define these fields in the .yaml file or these environment variables.

parameters for the for the authentication method “Token”
vault:
  enabled: true
  ...
  ...
  ...
  method: "userpassword"
  parameters:

    username: "<User name to connect to HashiCorp>"
    password: "<Password>"

Environment variables for HashiCorp - User/password

Additional environment variables you have to define for User/password:

DENODO_VAULT_PLUGIN

Set to hashicorpUserPassword

DENODO_VAULT_HASHICORP_USER

DENODO_VAULT_HASHICORP_PASSWORD

Example

Sample configuration file to connect to HashiCorp with User/password
vault:
  enabled: true
  provider: "hashicorp"
  config:
    address: "https://hashicorp.acme.com:8200"
    wrap_responses: false
    wrap_seconds: 20
    tls:
      trust_store_path: "file:/C:/Denodo/external_resources/hashicorp-vault.cer"
  auth:
    method: "userpass"
    parameters:
      username: "hashiCorpUserAccount"
      password: "encrypted:+72p/O7m0JCpr8krCvQh61ZJZhRBreB6a9P7nPc7Y4YpxewNNmzcJZO3QN9fUKs7iBDypOenBiHn71oRH4C56tYTuXcJzubD+x1PZEs7l42c32HKbg9l2iJFPhcEB1xtaDjJC25uyHfRxwJWAManrA=="

The sample right above and the sample right below are equivalent.

Sample environment variables to connect to HashiCorp with User/password
DENODO_VAULT_ENABLED=true
DENODO_VAULT_PROVIDER=hashicorp
DENODO_VAULT_PLUGIN=hashicorpUserPassword
DENODO_VAULT_HASHICORP_URL=https://hashicorp.acme.com:8200
DENODO_VAULT_HASHICORP_USER=hashiCorpUserAccount
DENODO_VAULT_HASHICORP_PASSWORD=encrypted:+72p/O7m0JCpr8krCvQh61ZJZhRBreB6a9P7nPc7Y4YpxewNNmzcJZO3QN9fUKs7iBDypOenBiHn71oRH4C56tYTuXcJzubD+x1PZEs7l42c32HKbg9l2iJFPhcEB1xtaDjJC25uyHfRxwJWAManrA==
DENODO_VAULT_HASHICORP_TRUST_STORE=file:/C:/Denodo/external_resources/hashicorp-vault.cer
DENODO_VAULT_HASHICORP_WRAP_RESPONSES=false
DENODO_VAULT_HASHICORP_WRAP_SECONDS=20

Proxy Server Configuration (Optional)

Each module of the Denodo Platform can connect to the vault via a proxy server. To do so, add the following parameters to the .yaml file OR define these environment variables:

subfields of the block “config” to connect to the credentials vault via a proxy
vault:
  enabled: true
  ...
  ...
  ...
  config:
    proxy:
      status: "<Possible values: "ON" or "OFF">
      host: "<Hostname of the proxy server. Mandatory>"
      port: "<Port of the proxy server. Mandatory>"
      user: "<Username to log in to the proxy server. Optional>"
      password: "<Optional>"

Environment variables for HashiCorp - User/password

DENODO_VAULT_PROXY_STATUS

DENODO_VAULT_PROXY_HOST

DENODO_VAULT_PROXY_PORT

DENODO_VAULT_PROXY_USER

DENODO_VAULT_PROXY_PASSWORD

Data Marketplace

  1. Verify that the file <DENODO_HOME>/conf/metadata-configuration-vault.yaml is present. Restart Data Marketplace if you created / modified this file after starting Data Marketplace.

  2. Log in to Data Marketplace as an administrator.

  3. Follow the steps of the section Configure the Connection Settings to the Virtual DataPort Servers of the Data Marketplace Guide.

    In Administration > Set-Up > Server > Database, you will see the toggle Obtain credentials from vault (this feature is not available for some authentication methods).

    In Account name, enter the path to the secret in the vault (e.g. secret/oracle/denodo_service_account). If the vault provider is Azure Key Vault, provide a value for each field.

Diagnostic & Monitoring Tool (Solution Manager Installation)

The connection to the vault in the Diagnostic & Monitoring Tool is different if it is for the Solution Manager installation or the Denodo Platform installation. This section is for the Solution Manager one.

  1. Add this line:

    com.denodo.util.vault.enabled=true

    to the following files:

    • <SOLUTION_MANAGER_HOME>/conf/diagnostic-monitoring-tool/DMTConfigurationParameters.properties

    • <SOLUTION_MANAGER_HOME>/conf/license-manager/LMConfigurationParameters.properties

    • <SOLUTION_MANAGER_HOME>/conf/solution-manager/SMConfigurationParameters.properties

    • <SOLUTION_MANAGER_HOME>/conf/vdp/VDBConfiguration.properties

  2. Verify the file <SOLUTION_MANAGER_HOME>/conf/metadata-configuration-vault.yaml exists.

  3. Restart Solution Manager, Solution Manager administration tool and the License Manager.

  4. Log into the Solution Manager with an administrator account and configure vaults in SM Database Configuration, which will automatically propagate the settings to DMT.

  5. Restart Solution Manager, Solution Manager administration tool and the License Manager.

  6. Open Design Studio and connect to the Virtual DataPort server //localhost:19999 (that is, the Virtual DataPort of the Solution Manager’s installation).

  7. Click the menu Administration > Server Configuration. And then, click Security > Credentials vault.

  8. Select Enable use of external credentials vault and mirror the provider settings configured in the .yaml file.

Diagnostic & Monitoring Tool (Denodo Platform installation)

  1. In the file <DENODO_HOME>/conf/dmt/DMTConfigurationParameters.properties, add this line:

    com.denodo.util.vault.enabled=true

  2. Verify the file <SOLUTION_MANAGER_HOME>/conf/metadata-configuration-vault.yaml exists.

  3. Log into the Diagnostic & Monitoring Tool with an administrator account.

  4. Click the menu Options > Database Configuration.

  5. When the database and authentication selected is compatible with using a vault, switch on Obtain credentials from vault and enter the path to the secret in Single path (for instance, secret/data/my-user).

    If the vault is Azure Key Vault, you have to enter the path for each credentials field (a path for username and another for password, access key and secret key, etc.).

  6. Save and restart the Diagnostic & Monitoring Tool.

Scheduler

  1. After creating/modifying the .yaml file, or setting these environment variables, restart Scheduler.

  2. Log in to the Scheduler Admin Tool with an administrator account.

  3. Click the menu Administration > Database > Database Metadata Settings tab.

  4. When the database and authentication selected is compatible with using a vault, switch on Obtain credentials from vault and enter the path to the secret in Account name (for instance, secret/data/my-user).

    If the vault is Azure Key Vault, you have to enter the path for each credentials field (a path for username and another for password, another for access key, another for secret key, etc.).

  5. Save and restart the Scheduler server

Solution Manager

  1. After creating/modifying the .yaml file, or setting these environment variables, restart Solution Manager and the License Manager.

  2. Log into the Solution Manager Web Tool with an administrator account.

  3. Click the menu Configuration > Solution Manager database.

  4. When the database and authentication selected is compatible with using a vault, switch on Obtain credentials from vault and enter the path to the secret in Account name (for instance, secret/data/my-user).

    If the vault is Azure Key Vault, you have to enter the path for each credentials field (a path for username and another for password, access key and secret key, etc.).

  5. Save and restart the License Manager and Solution Manager.

Virtual DataPort

You can configure Virtual DataPort to store its metadata in an external database. And it is possible that the credentials to connect to this database are obtained from the credentials vault of your organization.

Consider this:

  • If you have not enabled this feature before, we strongly suggest you read the page Storing the Metadata on an External Database of the Virtual DataPort Administration Guide before doing so. Enabling this feature has significant implications, you should be aware.

  • The feature Metadata database configuration uses the vault configuration defined in the .yaml or in the environment variables. It does not use the settings defined in Server Configuration > Credentials vault, which are only for data sources.

If you had already configured Virtual DataPort to store the metadata in an external database, you can begin obtaining the credentials from the vault and you will not lose any metadata. To do it, do this:

  1. After creating/modifying the .yaml file, or setting these environment variables, restart Virtual DataPort.

  2. Log in to Design Studio using an administrator account.

  3. Click the menu Administration > Metadata database configuration. Switch on the toggle Obtain credentials from vault to obtain the credentials to connect to this database, from the vault. Then, enter the account name that holds the credentials in the vault.

    If the account name you enter holds the same credentials you had entered in this dialog previously, after restarting Virtual DataPort, the same metadata will be available. The only difference will be how Virtual DataPort obtains the credentials.

  4. Restart Virtual DataPort again.

Add feedback