...

A number of JS7 - Job Templates support the use of a Credential Store:

• JS7 - JITL Database Jobs
  • JS7 - JITL SQLExecutorJob
  • JS7 - JITL PLSQLJob
  • JS7 - JITL SQLPLUSJob
• JS7 - JITL Mail Jobs
  • JS7 - JITL MailJob
  • JS7 - JITL MailInboxJob
• JS7 - JITL SAP Jobs
  • JS7 - JITL SAPS4HANAJob
• JS7 - JITL SSH Jobs
  • JS7 - JITL SSHJob

A number of JITL Job Templates require credentials, e.g. for example, to access a database.

• Security Considerations
  • Sensitive information in jobs should not be hard-coded, should not be used from parameters and should not be disclosed, e.g. written to log files.
  • Instead, a run-time interface is offered that allows to retrieve sensitive information to be retrieved from a Credential Store. References to Credential Store entries can safely be specified with argument values.
• Credential Store
  • A credential store allows to the securely store storage and retrieve retrieval of credentials for authentication, as well as connection details and other parameters
  • See JS7 - Use of Credential Store with Shell Jobs
  • See YADE Credential Store.
• Solution Outline
  • Access to the Credential Store is automatically provided for JS7 - Job Templates.

...

• file - required 
  
  • the path to the Credential Store file. This file can be located anywhere in the file system.
  • A relative path can be used that is calculated from the Agent's working directory:
    • By default this is the Agent's configuration directory, for example,
      • /home/sos/js7/agent/var_<http-port> for Unix
      • C:\ProgramData\sos-berlin.com\js7\agent for Windows
    • Example:
      • a relative path ./config/secret.kdbx maps to C:\ProgramData\sos-berlin.com\js7\agent\config\secret.kdbx

• password - optional 

  • the password for access to the Credential Store file. 
    

  • It is recommended not to use that this parameter ia not used and that instead to use a key_file to is used to access the Credential Store.

• key_file - optional, default: the path and name of the Credential Store file using the extension .key, for example, by default ./config/jobs.key is assumed if the Credential Store file ./config/jobs.kdbx is specified.

Anchor
database_jobs database_jobs

Use with JITL Database Jobs

JS7 - JITL Database Jobs can  can access a Credential Store in the following ways:

• by use of using a Hibernate configuration file,by use of
• using arguments

Use with a Hibernate Configuration File

The Hibernate access layer is used for database access and is frequently requires used with database credentials. The access information such as accounts, passwords and JDBC URLs etc. are is specified with the  Hibernate configuration files. 

Generally it is preferable not to use passwords to access a database directly but to use Integrated Security, Oracle Wallet etc. However, should there be a need to specify passwords, then instead of using a plain text password in a configuration file you , users can add your a password to a KeePass Credential Store and add a reference for to the Credential Store to your their Hibernate configuration file. This applies to the following JITL Database Jobs:

...

The full syntax is used when the complete URI is specified with each element of the Hibernate configuration file: 

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<hibernate-configuration>
    <session-factory>
        ...
        <property name="hibernate.connection.username">cs://secret/database/reporting@user?file=./config/secret.kdbx</property> 
        <property name="hibernate.connection.password">cs://secret/database/reporting@password?file=./config/secret.kdbx</property>
        <property name="hibernate.connection.url">cs://secret/database/reporting@url?file=./config/secret.kdbx</property>
        ...
    </session-factory>
</hibernate-configuration

...

The short syntax can be used if the Hibernate configuration file includes explicit references to the credential storeCredential Store:

<?xml version="1.0" encoding="UTF-8" standalone="no"?>
<hibernate-configuration>
    <session-factory>
        ...
        <property name="hibernate.connection.username">cs://@user</property> 
        <property name="hibernate.connection.password">cs://@password</property> 
        <property name="hibernate.connection.url">cs://@url</property>
         ...
        <property name="hibernate.sos.credential_store_file">./config/secret.kdbx</property>
        <property name="hibernate.sos.credential_store_key_file">./config/secret.key</property>
        <property name="hibernate.sos.credential_store_password">secret</property>
        <property name="hibernate.sos.credential_store_entry_path">/secret/database/reporting</property>
        ...
    </session-factory>
</hibernate-configuration

...

• <property name="hibernate.sos.credential_store_file"> => path to the Credential Store database file
• <property name="hibernate.sos.credential_store_key_file"> => path of to the key file for the Credential Store
• <property name="hibernate.sos.credential_store_password"> => password of the Credential Store database file
• <property name="hibernate.sos.credential_store_entry_path"> => folder hierarchy and entry name in the Credentials Store database file

Example for Hibernate Configuration File

...

References to a Credential Store can be directly specified from arguments. This applies to for the following JITL Database Jobs:

...

References to a Credential Store

References to a credential store Credential Store can be directly specified from arguments.

...

Anchor
mail_jobs mail_jobs

Use with JITL Mail Jobs

Use with Arguments

References to a Credential Store can be directly specified from arguments. This applies for the following JITL Mail Jobs:

• JS7 - JITL MailJob
• JS7 - JITL MailInboxJob

References to a Credential Store

References to a Credential Store can be directly specified from arguments.

Full Syntax

The full syntax is used when the complete URI is specified with an argument. For example:

Explanation:

• The jobs/mail/mail.sos-berlin.com value is an example for a path to an entry in the KeePass database that holds the credentials.
• The ./config/jobs.kdbx value is an example for a relative path to the KeePass database that holds the Credential Store.

Short Syntax

The short syntax can be used if arguments are specified with references to the Credential Store location, for example:

Anchor
ssh_jobs ssh_jobs

Use with

...

JITL SSH Jobs

Use with Arguments

References to a Credential Store can be directly specified from arguments. This applies to the following JITL SSH Jobs:

• JS7 - JITL SSHJob

References to a Credential Store

References to a credential store can be directly specified from arguments.

Full Syntax

The full syntax is used when the complete URI is specified with an argument, for example:

Explanation:

• The jobs/mail/ssh.sos-berlin.com xvalue is an example for the path to an entry in the KeePass database that holds the credentials.
• The ./config/jobs.kdbx value is an example for a relative path to the KeePass database that holds the Credential Store.

Short Syntax

The short syntax can be used if arguments are specified with references to the Credential Store location, for example: