Module io.helidon.config.encryption
Package io.helidon.config.encryption

Class EncryptionFilter

java.lang.Object
io.helidon.config.encryption.EncryptionFilter
All Implemented Interfaces:
ConfigFilter
public final class EncryptionFilter extends Object implements ConfigFilter
Provides possibility to decrypt passwords from configuration sources. Configuration can be used to enforce encryption (e.g. we will fail on clear-text value).

Password in properties must be stored as follows:

  • ${AES=base64} - encrypted password using a master password (must be provided to prime through configuration, system property or environment variable)
  • ${RSA=base64} - encrypted password using a public key (private key must be available to Prime instance, its location must be provided to prime through configuration, system property or environment variable)
  • ${ALIAS=alias_name} - no longer needed, please use ${alias_name}
  • ${CLEAR=text} - clear-text password. Intentionally denoting this value as a protectable one, so we can enforce encryption (e.g. in prod)
Example: 
 google_client_secret=${AES=mYRkg+4Q4hua1kvpCCI2hg==}
 service_password=${RSA=mYRkg+4Q4hua1kvpCCI2hg==}
 another_password=${service_password}
 cleartext_password=${CLEAR=known_password}
See Also:

  • Method Details

    • fromConfig

      public static Function<Config,ConfigFilter> fromConfig()
      Create a filter based on configuration (it takes its configuration from the configuration object it filters).
      Returns:
      ConfigFilter instance to register to config

    • builder

      public static EncryptionFilter.Builder builder()
      Builder to programmatically configure filter.
      Returns:
      Builder instance

    • apply

      public String apply(Config.Key key, String stringValue)
      Description copied from interface: ConfigFilter
      Filters an elementary config value before it is made available to the application via the Config API.
      Specified by:
      apply in interface ConfigFilter
      Parameters:
      key - configuration key associated with the Config node
      stringValue - original value to be filtered, never null
      Returns:
      original value or filtered (changed) value, never null