Vault Cipher Stream Provider

Note: this component is designated "advanced", which means that objects of this type are not expected to be created or altered in most environments. If you believe that such a change is necessary, you may want to contact support in order to understand the potential impact of that change.

The Vault Cipher Stream Provider is used to obtain a passphrase from a HashiCorp Vault server. That passphrase will be used to generate the encryption key that will protect the contents of the encryption settings database.

When starting up, this cipher stream provider will check for the existence of the file specified by the vault-encryption-metadata-file configuration property. If that file does not exist, then the provider will generate it with a set of metadata to use when deriving an encryption key from the passphrase retrieved from Vault.
The next time the cipher stream provider is started, that metadata file will be read and used in conjunction with the passphrase retrieved from Vault to derive the key needed to decrypt the contents of the encryption settings database.
Note that this Vault Cipher Stream Provider will only interact with Vault once when the server is started or when launching a tool that needs to access the encryption settings database. Upon retrieving the secret passphrase from Vault, an encryption key will be generated, and that key will be cached in memory so that it will not be necessary to retrieve the passphrase from Vault while the server or tool remains running.

dsconfig Usage

To list the configured Cipher Stream Providers:

dsconfig list-cipher-stream-providers
     [--property {propertyName}] ...

To view the configuration for an existing Cipher Stream Provider:

dsconfig get-cipher-stream-provider-prop
     --provider-name {name}
     [--tab-delimited]
     [--script-friendly]
     [--property {propertyName}] ...

To update the configuration for an existing Cipher Stream Provider:

dsconfig set-cipher-stream-provider-prop
     --provider-name {name}
     (--set|--add|--remove) {propertyName}:{propertyValue}
     [(--set|--add|--remove) {propertyName}:{propertyValue}] ...

To create a new Vault Cipher Stream Provider:

dsconfig create-cipher-stream-provider
     --provider-name {name}
     --type vault
     --set enabled:{propertyValue}
     --set vault-secret-path:{propertyValue}
     --set vault-secret-field-name:{propertyValue}
     [--set {propertyName}:{propertyValue}] ...

To delete an existing Cipher Stream Provider:

dsconfig delete-cipher-stream-provider
     --provider-name {name}