Secrets Vault

ODF 2 provides SecretsVaultService to isolate operations with Secrets Vault.

SecretsVaultService.java ODF 2 interface

public interface SecretsVaultService {

    /**
     * Retrieves a secure value from Secrets Vault.
     *
     * @param alias a secure entry alias to be retrieved
     * @return a secure entry
     * @throws PluginException when an entry with with the alias provided does not exist
     */
    SecureEntryDTO getEntry(String alias);

    /**
     * Retrieves the {@link Optional} secure value from Secrets Vault.
     * Returns {@link Optional#empty()} if the entry does not exist.
     * <p/>
     * Note that the implementation of this method can work on top of the underlying REST service.
     * In this case, the method is allowed to propagate exceptions from the underlying service.
     * For example, when "500 Internal Server Error" occurs, the method throws an exception instead of returning {@link Optional#empty()}.
     *
     * @param alias a secure entry alias to be retrieved
     * @return the {@link Optional} secure entry
     */
    Optional<SecureEntryDTO> getOptionalEntry(String alias);

    /**
     * Checks whether the secure entry with a provided alias exists.
     * <p/>
     * Note that the implementation of this method can work on top of the underlying REST service.
     * In this case, the method is allowed to propagate exceptions from the underlying service.
     * For example, when "500 Internal Server Error" occurs, the method throws an exception instead of returning the {@link Boolean} value.
     *
     * @param alias a secure entry alias to be checked against
     * @return {@code true} if the secure entry exists and {@code false} otherwise
     */
    boolean exists(String alias);

    /**
     * Saves provided values to Secrets Vault.
     *
     * @param alias a secure entry alias to be stored
     * @param key a secure entry key (usually username)
     * @param value a secure entry value (usually password)
     * @return true when the entry is successfully stored to Secrets Vault
     * @throws PluginException when an entry with the alias provided already exists
     */
    boolean saveEntry(String alias, String key, String value);

    /**
     * Updates a secure entry (key and value).
     *
     * @param alias a secure entry alias to be updated
     * @param key a secure entry key (usually username)
     * @param value a secure entry value (usually password)
     * @return true when the entry is successfully updated in Secrets Vault
     * @throws PluginException when an entry with the alias provided does not exist
     */
    boolean updateEntry(String alias, String key, String value);

    /**
     * Resets a secure entry value.
     * A new value is a randomly generated 20 symbols String.
     *
     * @param alias a secure entry alias to be reset
     * @return true when the entry is successfully reset in Secrets Vault
     * @throws PluginException when an entry with the alias provided does not exist
     */
    boolean resetEntry(String alias);

    /**
     * Deletes a secure entry from Secrets Vault.
     *
     * @param alias a secure entry alias to be deleted
     * @return true when the entry is successfully deleted from Secrets Vault
     * @throws PluginException when an entry with the alias provided does not exist
     */
    boolean deleteEntry(String alias);

}

To use SecretsVaultService in your Java-based Bot Task, inject com.workfusion.odf2.service.vault.SecretsVaultService into the constructor and set as the Bot Task's private property.

You may also need to add an out-of-the-box ControlTowerServicesModule module that provides SecretsVaultService if you haven't already done it in another place. To do that, add the @Requires(ControlTowerServicesModule.class) annotation to a Bot Task's class.

@BotTask
@Requires(ControlTowerServicesModule.class)
public class MyBotTask implements AdHocTask {

    private final SecretsVaultService secretsVaultService;

    @Inject
    public MyBotTask(SecretsVaultService secretsVaultService) {
        this.secretsVaultService = secretsVaultService;
    }

    @Override
    public TaskRunnerOutput run(TaskInput taskInput) {
        SecureEntryDTO entry = secretsVaultService.getEntry("my-alias");

        String key = entry.getKey();
        String value = entry.getValue();

        return taskInput.asResult();
    }

}

SecretsVaultService provides the following methods:

• SecureEntryDTO getEntry(String alias) retrieves a secure value from Secrets Vault. If there is no entry with the alias provided, PluginException is thrown.
• Optional<SecureEntryDTO> getOptionalEntry(String alias) retrieves a secure value from Secrets Vault. If there is no entry with the alias provided, the method returns the Optional.empty() value.
• boolean exists(String alias) checks whether a secure entry with the alias provided exists in Secrets Vault. Returns true if the entry exists and false otherwise.
• boolean saveEntry(String alias, String key, String value) saves provided values to Secrets Vault. If an entry with the alias provided already exists in Secrets Vault, the method throws PluginException.
• boolean updateEntry(String alias, String key, String value) updates a secure entry (key and value). If an entry with the alias provided does not exist in Secrets Vault, the method throws PluginException.
• boolean resetEntry(String alias) resets a secure entry value by setting a randomly generated 20 symbols String. If an entry with the alias provided does not exist in Secrets Vault, the method throws PluginException.
• boolean deleteEntry(String alias) deletes a secure entry from Secrets Vault. If an entry with the alias provided does not exist in Secrets Vault, the method throws PluginException.

note

SecretsVaultService is built on top and limited to Secrets Vault REST API.