Configuring vault-enabled integration server

Edit online

The Eclipse secure storage vault eliminates the security risk where the message flow use to store the password in the plain text format.

About this task

The secure storage password can be accessed from the Eclipse environment, but the runtime environment cannot access the stored password from the Eclipse secure storage vault. Hence, to eliminate the security risk, you need to configure the integration server to store the password.

You can configure Eclipse secure storage vault for the integration server by running the following commands sequentially based on your datasource configuration.

  • Datasource is configured with a username and password, but no certificates.

    Run step 1, 3, and 4.

  • Datasource is anonymous and has only certificates.

    Run step 1, 2, and 4.

  • Datasource is configured with a username and password, and has certificates.

    Run step 1, 2, 3, and 4.

Procedure

  1. Create a vault in the integration server by using the following command. 
    mqsivault --work-dir <workdirectory> --create --vault-key <vaultkeyname>
  2. Store the credentials by using the following command. 
    mqsicredentials --work-dir <workdirectory> --vault-key <vaultkeyname> --create --credential-type ldap --credential-name <credentialname> --username <username> --password <password>
    Note: The CREDENTIAL_NAME property specifies the name of the credential that is used in the mqsicredentials command. It is a combination of the datasource-mapping path, forward slash (/), and username.
    For example, the datasource-mapping path is /Source/opcServer/prosys and username is acmfgPrivateKeyUser. 
    /Source/opcServer/prosys/acmfgPrivateKeyUser
  3. Store the credentials in the integration server by using the following command. 
     mqsisetdbparms -w <workdirectory> -n ldap::<credentialname> -u username -p <password>
  4. Start the integration server by using the following command. 
    IntegrationServer --work-dir <workdirectory> --vault-key <vaultkeyname>
    The password is taken from the vault key that is provided in the command.