Page Comparison

🤔 Description

To ensure a higher level of credential security that may be required in specific industries, ACLI 11.0 introduces the Secure Properties functionality.

Secure Properties replaces the acli.properties file preventing any breach of security that could occur if the credentials in the n acli.properties were intercepted.

🌱 Solution

The Secure Properties in ACLI 11.0 provides a key-store-based credential storage solution using password based encryption (PBE). The specific key store format utilized is the Bouncy Castle provided UBER format.

The Secure Properties key can store any value, while it prevents sensitive credentials from being stored as plain text on disk.

Creating a key store

A new key store is created when the action setSecureProperty is run for the first time. For example:

$ acli system setSecureProperty --name my.secret --secret -
Enter secure value: <secret value prompt>
Secure properties file does not yet exist. Creating...
Enter new secure properties password: <new password prompt>
Confirm secure properties password: <new password prompt>
Remember your password, it cannot be recovered!
Secure properties file created.
Value for key 'foo' set in secure properties file.

Breaking this down, you can see that first ACLI will prompt for the value of the secret to be stored, and then it will prompt for the new key store file password (with confirmation).

Once created, the key store file (named .acli.keystore) can be found in your home directory. Each ACLI user on a given system has their own such file (because of other ACLI limitations, it is still necessary on a multi-user system for each user to maintain their own ACLI installation). The key store file path can be overridden to point to an alternative location through the use of the environment variable ACLI_SECURE_PROPERTIES. This can be useful if you need to work with multiple key stores or multiple installations of ACLI, but typically should not be needed.

Referencing secrets in acli.properties

When in use, the key store file can be used to provide values to acli.propertiesby way of substitution variables similar to the current method of referring to environment variables or other properties (i.e., using ${my.variable} syntax). In ACLI 11.0.0, the default syntax for referring to key store values is with a variation of that syntax of the form ${secret:my.secret} (note the addition of the secret: prefix).

Unlocking the key store

Once your ACLI configuration refers to secure property values (i.e., using ${secret:...} style variables in acli.properties) then you will be prompted to unlock the key store each time you run an ACLI command (including starting the ACLI Shell).

Normally, this means that ACLI will prompt you interactively for your key store password before it continues (or read it from stdin when not connected to a tty). At your discretion, you may optionally short-circuit this prompting behavior by setting the environment variable ACLI_SECURE_PROPERTIES_PASSWORD with your password as a value.

Actions

Use ACLI actions, part of the ACLI system client, to create, update, read, and delete key-value pairs stored in the Secure Properties key store.

To use a secure property in acli.properties, follow the example:

my-jira = jiracloud -s https://myjira.atlassian.net -u me@example.com -t ${secret:my-jira.token}

The table shows how you can work with the secure properties and provides examples.

$ acli system -a setSecureProperty --name my-jira.token --secret
Enter secure properties password: <password prompt>
Value for key 'my-jira.token' set in secure properties file.

$ acli system -a clearSecureProperties
Enter secure properties password: <password prompt>
Enter CONFIRM to permanently clear all secure properties (CANNOT be undone): CONFIRM
Secure properties cleared.

$ acli system -a getSecureProperty --name my-jira.token
Enter secure properties password: <password prompt>
Secure property 'foo' exists in the secure properties file.

$ acli system -a getSecureProperty --name foo --outputFormat 2
Enter secure properties password: <password prompt>
Value of secure property 'my-jira.token': <your token value>

$ acli system -a importSecureProperties -f import.keystore
Enter secure properties password: <destination password prompt>
Enter inbound secure properties password: <source password prompt>
Imported 0 secure properties.
Ignored: buz,foo. Use --replace to overwrite existing values.

$ acli system -a importSecureProperties -f import.keystore --include '(?i)^F' --replace
Enter secure properties password: <destination password prompt>
Enter inbound secure properties password: <source password prompt>
Imported 1 secure property: foo.

$ acli system -a removeSecureProperty --name my-jira.token
Enter secure properties password: <password prompt>
Enter CONFIRM to permanently remove the secure property 'my-jira.token': CONFIRM
Removed value for key 'my-jira.token' from secure properties file.
Deleted empty keystore file.

$ acli system -a exportSecureProperties -f export.keystore --exclude '(?i)^F' --replace
Enter secure properties password: <source password prompt>
Enter outbound secure properties password: <destination password prompt>
Exported 1 secure property: buz.

$ acli system -a getSecurePropertyList --outputFormat 2
Enter secure properties password:
2 secure properties in list
"Name","Value"
"buz","qux"
"foo","foo"