You are viewing an old version of this page. View the current version.

Compare with Current View Page History

« Previous Version 13 Next »

Description of SOSCredentialStore - SOSCredentialStore

The "Password Safe" (CS Credential Store ) offers possibilities to store encrypted connection data and any other data securely and interdependently of application (i.e. JADE). The access to the CS is only possible with Access method such as SSH key or password.
Currently CS is using "KeePass" and "KeePassX" with the db verson 1.0, thus CS can be used on most popular OS platforms.
The advantage of using CS is , that CS store access credentials ( and also other information/parameters) in standarized , secure and encrypted database i.e. Keepass. JADE access the CS Database using standard interface. CS Database can only be access using Password, encryption-key file(ppk) or combination of both. CS Password is also used to encrypt contents stored in CS Database with AES.
CS can also be used for securely store information/parameters along side password, Database connection URL, runtime decryption key and other access data.
Following information can be retrieved from CS's standard fields
Feature: UserID : The User identifaction of the user who is authorized for the operation.
Feature: Password : Assigned password for the user.

Feature: Server-Name : Target Server-Name or IP-address

Feature: Notes : In "notes" section of the CS other parameters/options can be stored i.e. extra JADE parameters , Database connection URL etc. The extra options are defined similarly as they are defined on the command line.

Feature: File-Attachment : Any file such as PGP file, SSH private key file can be stored in the CS as file attachment. Application will retrieve the attached file on run time and will delete the file "immediately" once operation is finished.

Example of JADE Profile using Credential Store : jade_setting.ini

 {{
                                       
    [Keepass_DataBase_WithPassword]
    use_credential_Store     = true
    CredentialStore_FileName = R:\backup\sos\java\development\com.sos.VirtualFileSystem\keepassX-test.kdb
    CredentialStore_KeyPath  = sos/server/homer.sos
    CredentialStore_password = testing
</source>


<source>
    [ReceiveUsingKeePass]
    include                        = Keepass_DataBase_WithPassword
    source_CredentialStore_KeyPath = sos/server/homer.sos
    source_include                 = Keepass_DataBase_WithPassword
    source_Dir                     = /tmp/test/jade/out
    source_make_Dirs               = true
    source_loadClassName           = com.sos.VirtualFileSystem.FTP.SOSVfsFtp2
    target_protocol                = local
    target_dir                     = /tmp/test/jade/in
    operation                      = copy
    file_spec                      = \.txt$
    transfer_mode                  = ascii
    source_transfer_mode           = ascii
    loadClassName                  = com.sos.VirtualFileSystem.FTP.SOSVfsFtp2
</source>
}}                                     

==Parameter used by SOSCredentialStore==

{| border="1"
|+ List of parameter
! ! Name || title || mandatory || default
|- 
| [[#CredentialStore_ProcessNotesParams|CredentialStore_ProcessNotesParams]]
| Process additional parameters from "notes" filed
| false
| false
|- 
| [[#CredentialStore_OverwriteExportedFile|CredentialStore_OverwriteExportedFile]]
| CredentialStore_OverwriteExportedFile
| false
| true
|- 
| [[#CredentialStore_Permissions4ExportedFile|CredentialStore_Permissions4ExportedFile]]
| CredentialStore_Permissions4ExportedFile
| false
| 600
|- 
| [[#CredentialStore_DeleteExportedFileOnExit|CredentialStore_DeleteExportedFileOnExit]]
| Delete Attachment On Exit of Application
| false
| true
|- 
| [[#CredentialStore_ExportAttachment|CredentialStore_ExportAttachment]]
| Export attached file to disc
| false
| false
|- 
| [[#CredentialStore_ExportAttachment2FileName|CredentialStore_ExportAttachment2FileName]]
| Name of the extracted attachment file
| false
| 
|- 
| [[#CredentialStore_KeyFileName|CredentialStore_KeyFileName]]
| Name of the File containing the private Key
| false
| 
|- 
| [[#CredentialStore_password|CredentialStore_password]]
| Password for CS
| false
| 
|- 
| [[#CredentialStore_AuthenticationMethod|CredentialStore_AuthenticationMethod]]
| Authentication Method for the CS
| true
| privatekey
|- 
| [[#CredentialStore_StoreType|CredentialStore_StoreType]]
| The Type of the crendential store application
| false
| KeePass
|- 
| [[#CredentialStore_KeyPath|CredentialStore_KeyPath]]
| Path and Key for the credentials
| true
| 
|- 
| [[#CredentialStore_FileName|CredentialStore_FileName]]
| Name of Credential Database
| true
| 
|- 
| [[#use_credential_Store|use_credential_Store]]
| use credential store for authentication
| false
| false
|}


====Parameter <span id="CredentialStore_ProcessNotesParams">CredentialStore_ProcessNotesParams</span>: Process additional parameters from "notes" filed====
----
In "notes" filed of the CS Database extra parameters like DB connection string , Proxy server IP etc. can be defined. These paramters will be processed with the other parameters defined in settings file, JITL parameters, but "IMP" if an paramter with same name is defined in the "notes" section , parameter value in "notes" will have priority. 
{code:language=bash}
                                -dburl=test -verbose=2 -password=12345

<source>
                            
In the "notes" propertry of KeePass can be used to store extra parameters i.e. options such as DB connection string , proxy server settings etc.
Data-Type : SOSOptionBoolean
The default value for this parameter is  {*}false{*}.
Use together with parameter:  
* [use_credential_Store|#use_credential_Store] - use credential store for authentication

Alias: CS_ProcessNotesParams

h4. Parameter <span ih1. "CredentialStore_OverwriteExportedFile">CredentialStore_OverwriteExportedFile</span>: CredentialStore_OverwriteExportedFile
----
At runtime JADE can export the file defined in the attachment filed of the CS DB to the local file system. for example If attached file is an SSH key and JADE want to use the Key file for Data Exchange operation Usually if JADE want to use an SSH key , stored in the CS as attachement JADE has to export attached file into predefined directory i.e. $HOME/.ssh. To avoide any unwanted overwriting of any existing file into $HOME/.ssh folder, "IMP"" set this parameter as "false".
Data-Type : SOSOptionBoolean
The default value for this parameter is  {*}true{*}.
Use together with parameter:  
* [use_credential_Store|#use_credential_Store] - use credential store for authentication

Alias: CS_OverwriteExportedFile


h4. Parameter <span id"CredentialStore_Permissions4ExportedFile">CredentialStore_Permissions4ExportedFile</span>: CredentialStore_Permissions4ExportedFile
----
At runtime JADE can export the file defined in the attachment filed of the CS DB to the local file system. for example If attached file is an SSH key and JADE want to use the Key file for Data Exchange operation Usally if JADE want to use an SSH key , stored in the CS as attachement JADE has to export attached file into predefined directory i.e. $HOME/.ssh and key file should have specific permissions. It could be possible that "application user" calling the JADE have different set of application, to avoide any file permission issue during run time, "IMP" set the required file permission using these parameters 
{code:language=bash}
                                -CredentialStore_Permissions4ExportedFile="600"

<source>
                            
  
                            
                                -CredentialStore_Permissions4ExportedFilh1. "600"
                            
                            
                            
                        

</source>
Data-Type : SOSOptionString
The default value for this parameter is 600.
Use together with parameter:

Alias: CS_Permissions4ExportedFile

Parameter <span id"CredentialStore_DeleteExportedFileOnExit">CredentialStore_DeleteExportedFileOnExit</span>: Delete Attachment On Exit of Application


At runtime JADE will export the attached file to local file system , once operation is completed , irrespecive of operation's status (successfully or unsucessfully ), by default JADE will delete this file. In special case i.e. for debuging or any other reason if you want that JADE should not delete the file "IMP" set this parameter as FALSE
Data-Type : SOSOptionBoolean
The default value for this parameter is true.
Use together with parameter:

Alias: CS_DeleteExportedFileOnExit

Parameter <span ih1. "CredentialStore_ExportAttachment">CredentialStore_ExportAttachment</span>: Export attached file to disc


If JADE need an file, stored in the CS DB as attachemenr, at runtime JADE can export the file on local filesystem. By default JADE don't export attached file. "IMP" if JADE need "attachment" file at runtime , set this parameter as TRUE
Data-Type : SOSOptionBoolean
The default value for this parameter is false.
Alias: CS_ExportAttachment

Parameter <span id"CredentialStore_ExportAttachment2FileName">CredentialStore_ExportAttachment2FileName</span>: Name of the extracted attachment file


To use the file stored in the CS as attachment, during an operation, JADE has to export the attached file on local filesystem. To define the name of exported file name on local filesystem , use this parameter.

                                -CredentialStore_ExportAttachment2FileName="archive_server_ras.ppk"

<source>
                            

</source>

                            example: additional parameters in notes section
                            
                                -CredentialStore_ExportAttachment2FileName="archive_server_ras.ppk"
                            
                            
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionOutFileName
Use together with parameter:

Alias: CS_ExportAttachment2FileName

Parameter <span ih1. "CredentialStore_KeyFileName">CredentialStore_KeyFileName</span>: Name of the File containing the private Key


Credential store can be accessed by the JADE using an private key or with password or combination of both. define the path/location of the ssh key file using this parameter.

                                -CredentialStore_KeyFileName="jade_cs_rsa.ppk"

<source>
                            

</source>

                                -CredentialStore_KeyFileName="jade_cs_rsa.ppk"
                            
                            
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionInFileName
Use together with parameter:

Alias: CS_KeyFileName

Parameter <span id"CredentialStore_password">CredentialStore_password</span>: Password for CS


Credential store can be accessed by the JADE using an private key or with password or combination of both. define the CS's access password using this parameter. "IMP" always set strong password for CS.

                                

<source>
                            

</source>

                                -CredentialStore_password="55ybr293N!2BButnY4,w"
                            
                            
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionPassword
Use together with parameter:

Alias: CS_password

Parameter <span ih1. "CredentialStore_AuthenticationMethod">CredentialStore_AuthenticationMethod</span>: Authentication Method for the CS


There are three possible combination of Authentication methods.

                                
                                
                                
                                
                                


<source>
                            

</source>

                            example: additional parameters in notes section
                            
                                -CredentialStoreAuthenticationMethod="password"
                                 --- OR --- 
                                -CredentialStoreAuthenticationMethod="privatekey"
                                 --- OR --- 
                                -CredentialStoreAuthenticationMethod="password+privatekey"
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionString
The default value for this parameter is privatekey.
Use together with parameter:

This parameter is mandatory.
Alias: CS_AuthenticationMethod

Parameter <span id"CredentialStore_StoreType">CredentialStore_StoreType</span>: The Type of the crendential store application


At present only "KeePass" as CS DB is supported and only "KeePass" as valid parameter value is permitted.
Data-Type : SOSOptionString
The default value for this parameter is KeePass.
Use together with parameter:

Alias: CS_StoreType

Parameter <span ih1. "CredentialStore_KeyPath">CredentialStore_KeyPath</span>: Path and Key for the credentials


This Option specifies the path of the Access key for the entry which has to be used for the credentials.
Credential store can be accessed by the JADE using an private key or with password or combination of both. define the path/location of the ssh key file using this parameter.

                                

<source>
                            

</source>

                            example: additional parameters in notes section
                            
                                -CredentialStore_KeyFileName="/ssh/server1/sap-upload"
                            
                            
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionString
Use together with parameter:

This parameter is mandatory.
Alias: CS_KeyPath

Parameter <span id"CredentialStore_FileName">CredentialStore_FileName</span>: Name of Credential Database


The path and name of the KeePass or KeePassX DB file with the file extension ".kdb".

                                jade.sh -CredentialStoreFileName="/etc/keystore/sap_jade.kdb" ...

<source>
                            

</source>

                                CredentialStoreFileName = /etc/keystore/sap_jade.kdb

<source>
                            

</source>

                                CSOptions.CredentialStoreFileName.Value("/etc/keystore/sap_jade.kdb");

<source>
                            

</source>

                            example: additional parameters in notes section
                            
                                jade.sh -CredentialStoreFileName="/etc/keystore/sap_jade.kdb" ...
                            
                            
                                CredentialStoreFileName = /etc/keystore/sap_jade.kdb
                            
                            
                                CSOptions.CredentialStoreFileName.Value("/etc/keystore/sap_jade.kdb");
                            
                            
                                todo: This is the explanation for this example.
                            
                        
 

Data-Type : SOSOptionInFileName
Use together with parameter:

This parameter is mandatory.
Alias: CS_FileName

Parameter <span id="use_credential_Store">use_credential_Store</span>: use credential store for authentication


If you want to store your access data i.e. user-id , password, SSH key , DB URL in encrypted CS DB, unable this parameter and configure the rest if the CS accordinglly. By default JADE will look for the parameters from settings.ini, command line or from JITL job.
Data-Type : SOSOptionBoolean
The default value for this parameter is false.

</text>

      </revision>
   </page>

</mediawiki>

  • No labels