bytechef icon indicating copy to clipboard operation
bytechef copied to clipboard

[feature]: Support for securely storing and obtaining authorization data in external store/vault

Open ivicac opened this issue 2 years ago • 0 comments

The majority of tasks that represent connectors for various services require authorization to use those services. Credentials need to be securely stored inside the database in the connection table. To achieve this, all credential data needs to be encrypted with a key. Each workflow task definition that requires credentials should define a reference(unique name used when storing credentials in the database) to credentials stored inside the database. This way, any sensitive data will not be exposed, and workflow definitions become easily shareable.

The engine needs to have support for obtaining the encryption key through the following strategies:

  • [x] File-based The workflow engine creates a random encryption key automatically on the first launch and saves it in the ~/.bytechef folder. That key is used to encrypt the credentials before they get saved to the database.

  • [ ] AWS Key Management service - https://aws.amazon.com/kms/ In the future, the following strategies should be considered:

  1. Google Cloud Key Management - https://cloud.google.com/security-key-management
  2. Azure Vault - https://azure.microsoft.com/en-us/services/key-vault/
  3. Vault-based - https://www.vaultproject.io/ Vault project is used to obtain the encryption key. Spring has dedicated support for Vault. For more information, check https://spring.io/projects/spring-vault

ivicac avatar Oct 20 '23 18:10 ivicac