Vault configuration
Use the Vault configuration to supply a prepopulated vault that was
created in IBM® App Connect Enterprise. This vault stores encrypted credentials for IBM App Connect Enterprise
Toolkit message flows to use when they connect to secured
resources.
Vault configuration works with the
Vault key configuration. Use both of these configurations if your IBM App Connect Enterprise
Toolkit integration is configured to connect to secured
resources.
The Vault and Vault key configurations were deprecated in IBM App Connect Operator 12.11.0. Instead, use the Vault archive
and Vault archive key configurations to provide encrypted credentials that are
exported from an integration server vault or external directory vault in IBM App Connect Enterprise. You can create Vault archive and
Vault archive key configurations for integration runtimes at version 13.0.3.0-r1 or
later.
Summary of key details
- File name or type
- vault.zip
- Does the file contain secrets?
- Yes
- Location of imported or extracted data
- /home/aceuser/ace-server/config/vault
- Maximum number of vault configurations allowed per integration runtime
- One
The vault.zip file
The Vault configuration requires a vault.zip file that a
deployed integration uses to connect to a secured resource such as a remote server or service.
You can specify only one vault.zip file per integration runtime. The contents of the vault.zip file are extracted to the /home/aceuser/ace-server/config directory in the work path of the runtime.
- Create or generate a vault (with a specified vault key) in App Connect Enterprise. Several methods are available to create a vault, including
the following two options.
- From the App Connect Enterprise Console, create a vault by using the mqsivault command, then use the mqsicredentials command to configure security credentials and store them in
encrypted form in the vault. Each independent App Connect Enterprise integration
server has its own vault that is stored in the work directory, with its own vault key.
For more information, see Configuring encrypted security credentials in the App Connect Enterprise documentation.
- From the IBM App Connect Enterprise Toolkit, create an integration server that includes a Discovery Connector message flow node such as a Salesforce Request node. You create a policy project, specify a vault key, then use the Connector Discovery wizard to configure the node. After you save the connection details for the client application, the credentials are stored in encrypted form in a generated vault in the work directory. The other connection details (such as endpoint information) are saved in a generated policy in the policy project. This policy references the credentials that were saved to the vault and controls access to the application at run time.
- From the App Connect Enterprise Console, create a vault by using the mqsivault command, then use the mqsicredentials command to configure security credentials and store them in
encrypted form in the vault. Each independent App Connect Enterprise integration
server has its own vault that is stored in the work directory, with its own vault key.
- Go to the work directory of the App Connect Enterprise integration server and locate the folder for the populated vault. The default path to this folder is workdir/config/vault; for example, C:\Users\MYname\IBM\ACET12\workspace\FD_TEST_SERVER\config\vault (on Windows).
- Compress the vault folder to a vault.zip file.
A sample vault.zip file is attached to show the expected structure: vault.zip.
Vault configuration on
the Configurations tab of the Manage page and import
your vault.zip file. For more information, see Providing credentials and secrets in configurations.