Credential Store
Starting with Intrexx version 12.0.0
The Credential Store is a secure, centralized store with its own namespace. You can find it in the "Integration" module on the left, below the "Connection Data Management" entry.
Here, credentials used in processes can be stored independently of the processes and made available at runtime.
The Credential Store is required for managing processes in public Git repositories and for sharing processes with third parties. It enables an improved staging environment from the test environment to the production environment.
The right-hand pane lists the credentials defined in the portal, along with their names, descriptions, and last modified dates.
In the upper-right corner, you'll find the " 
" button labeled "Add Login Information." Clicking on it opens a dialog box where you can create new credentials.
Create Credential
The name of the credential must be unique and may contain only the following characters: [a-z][A-Za-z0-9]*.
Enter the secret value of the credential here as well.
If necessary, you can also enter a description.
Click "OK" to save the changes and close the dialog box.
"Edit Registration Information"
Opens a dialog box where you can edit the details of the credential currently selected in the list.
Edit Credential
The name of the credential cannot be changed. The password and description can be edited. Click "OK" to save the changes and close the dialog box. The changes are applied immediately and are available during the execution of processes.
Remove login information
Deletes the credential currently selected in the list. During removal, the system checks whether the selected credential is being used in any processes. If so, the system will prompt you to confirm whether you still want to delete the credential.
View Usage in Intrexx
Opens a dialog box that displays the processes using the credential.
Use in Intrexx
This checks which processes use the selected credential. The processes found are displayed in a list.
Click "OK" to save the changes and close the dialog box.
Refresh
You can reload the credential list from the server via the "Credential Store / Refresh" option in the main menu or by clicking the corresponding " 
" button on the toolbar.
credentialstore.cfg
All credentials are stored in the XML file "credentialstore.cfg" in the portal directory "internal/security/credentialstore." Here's an example:
<?xml version="1.0" encoding="UTF-8"?>
<credentials xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.intrexx.com/intrexx/2024/credential-store/ http://schemas.unitedplanet.de/intrexx/2024/package/de/uplanet/lucy/server/credentialstore/cfg/res/credentialstore.xsd">
<credential name="exchangeOnline" lastModified="2024-03-11T15:39:35.690Z" value="ixape-v1:58C100AF640BE086AFCCFF866ECA5405EF4325DF">
<description>Client Secret für Exchange Online</description>
</credential>
<credential name="imapServer" lastModified="2024-03-11T16:14:19.615Z" value="ixape-v1:1D9640EF237F1AFA2EADF6DF3AF253D3ED4EEAC2BD1911039E383E63FF02F8">
<description>Passwort für Standard-IMAP-Server</description>
</credential>
<credential name="imapServerTest" lastModified="2024-03-13T15:49:02.189Z" value="ixape-v1:58C100AF640BE086AFCCFF866ECA5405EF4325DF">
<description>Passwort für den Test-IMAP-Server</description>
</credential>
</credentials>Credentials in Process Elements
In the "Processes" module, credentials can be selected in various locations within the properties of process elements; they can also be created and added to the credential store. Alternatively, the password can also be saved directly within the process.
Credentials are stored in BeanProperty in the format "urn:credentialStore:credentialName," where "credentialName" is the name assigned to the credential in the credential store.
IMAP Event Source (Type: "Standard IMAP")
For the IMAP event source, the password can be set in the item's properties on the "Email Server" tab.
If you click the small downward-pointing arrow to the right of the " 
" key icon, a menu will open where you can choose whether the password should be stored with the process (default) or retrieved from the Credential Store.If you select "From Credential Store," the 
key icon changes, and the password input field becomes a drop-down list from which you can select the desired credential. The name of the credential is then saved during the process.
If you click directly on the " " key icon, a dialog box will open where you can edit existing credentials and create new ones.
Select Login Information
All existing credentials are listed here. By clicking "Add Login Information" at , you can create new credentials and edit existing ones from here.
IMAP Event Source (Type "Exchange Online")
Here, instead of a password, you can set or select the client secret in the same way as for the IMAP event source with the "Standard IMAP" type.
Generic Elements
When editing a property, you can select a credential by clicking " " ("Insert value from login information") if the property is of type "String" and the "@SecurityCredential" annotation is set on the setter and getter methods of the bean property in the runtime class.
@SecurityCredential
public String getPassword()
{
return m_strPassword;
}
@SecurityCredential
public void setPassword(String p_strPassword)
{
m_strPassword = p_strPassword;
}
"Expert" tab
Using credentials via the "Expert" tab in the properties of process elements works in the same way as for generic elements.
Groovy API
The "g_credentials" context object is used to access the credential store. You can find more information here.
Security
The following measures are in place to ensure the security of the credential store:
-
The credential values are stored in an obfuscated form in the "credentialstore.cfg" file.
-
Permissions Check: Users need the "Manage Security Settings" portal permission to add, edit, or remove credentials.
-
Limited data transfer between client and server: Credential values are transferred from the client to the server only when they are added or edited. Conversely, no values are transmitted from the server to the client.
-
When exporting a process, only the names of the credentials are exported, not their values. During or after the process import, the user can reset the values if they have the necessary portal permissions.
-
By default, the portal export removes the credential values from credentialstore.cfg. After the portal import, the user can reset the values if they have the necessary portal permissions.
Publication of Proceedings
Check for Undefined Credentials
Before a process is published, the system checks whether the credentials used in the process are defined in the portal. During this process, the bean properties of the elements and the Groovy scripts are checked.
Undefined credentials may occur in a process—for example, if an imported process contains a credential that does not exist in the current portal. If there are undefined credentials in the process, a corresponding message is displayed, which also points out potential problems when publishing or executing the process. The user has the option to continue or cancel the publication.
In the element properties, undefined credentials are marked with the suffix (undefined) (exception: generic elements and the "Expert" tab).
Notes Tab
In addition to the warning message, the "Warnings" section lists the relevant elements and, if applicable, Groovy script files. When you hover over the warning triangle, the entry's description appears.
Double-clicking an element highlights it on the workspace.
Groovy script files can also be displayed. Double-clicking the corresponding entry opens the script editor. The cursor jumps to the line where an undefined credential is first used.
metaCredential.xml
When the process is published, the credential names used in the process are written to the new "metaCredential.xml" file in the process directory. The credential names are collected from the "model.xml" file and from files with the ".groovy" extension.
<meta xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.intrexx.com/intrexx/2024/meta/credential/ http://schemas.unitedplanet.de/intrexx/2024/package/de/uplanet/lucy/credentialstore/meta/res/metacredential.xsd">
<credential name="imapServer"/>
<credential name="imapServerTest"/>
<credential name="myCredential"/>
</meta>
Process Import
If a credential is used in at least one of the processes selected for import, the new "Credentials" page will appear in the Import Wizard.
The names of the credentials from the selected processes are displayed here. The source of the names is the "metaCredential.xml" file in each case.
In the first column of the credential list, click "Info" next to " 
" to see which processes are using the credential. The credential name is displayed in the second column.
In the third column, you'll find a checkbox that allows you to create a new credential if it doesn't already exist in the target portal.
Configure Login Information
Clicking "Configure Login Information" at 
opens a dialog box where you can configure the new credential. When creating a new credential, you must configure it, which means you must set a password. The name of the credential must be unique and may contain only the following characters: [A-Za-z][A-Za-z0-9]*. Optionally, you can also enter a description.
If the checkbox is selected and the new credential is configured, it will be added to the credential store during the import process.
To create new credentials, you need the portal permission "Manage Security Settings. "
The fourth column shows whether there is a mapping for the credential from the portal's credential store. The mapping occurs automatically if a credential with the same name as the one in the import package exists in the portal. It is not possible to assign a different name, because its use in Groovy scripts cannot be determined with 100% certainty, and therefore it would not always be possible to adjust the name.
Alternatively, missing credentials can also be added immediately to the portal's credential store. To do this, open the Credential Store by clicking the "Open Credential Store" button. You can find more information here.
When you close the dialog box, the mappings to the portal are updated.
If not all credentials have been assigned or the creation of new credentials has not been fully configured, a warning message will appear when you click "Next." The import can still be continued upon request.
Portal Export
Selecting the "Clear Credential Store" setting removes the values (passwords) of the credentials from the "internal/security/credentialstore/credentialstore.cfg" file in the portal export, meaning they will not be included. Existing credentials will then be exported with only their names and descriptions. The advantage of this is that the credentials—including their names and descriptions—remain in the credential store after the portal import, and for each credential, you can see in which processes it is used.
Here is the "credentialstore.cfg" file after the portal export with the option enabled:
<?xml version="1.0" encoding="UTF-8"?>
<credentials xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://schemas.intrexx.com/intrexx/2024/credential-store/ http://schemas.unitedplanet.de/intrexx/2024/package/de/uplanet/lucy/server/credentialstore/cfg/res/credentialstore.xsd">
<credential name="exchangeOnline" lastModified="2024-03-11T15:39:35.690Z">
<description>Client Secret für Exchange Online</description>
</credential>
<credential name="imapServer" lastModified="2024-03-11T16:14:19.615Z">
<description>Passwort für Standard-IMAP-Server</description>
</credential>
<credential name="imapServerTest" lastModified="2024-03-13T15:49:02.189Z">
<description>Passwort für den Test-IMAP-Server</description>
</credential>
</credentials>
The names and descriptions of the credentials are retained, so that after the portal import, only the values need to be reset—there is no need to recreate all the credentials. This also maintains the connection to the processes, so that you can, for example, view how the credential is used in the credential store. By default, the "Clear Credential Cache" setting is enabled.
General information on "Portal Export" can be found here.
Portal Export via Script
-
Linux: $INTREXX_HOME/bin/linux/exportportal.sh
-
MaxosX: $INTREXX_HOME/bin/macosx/exportportal.sh
-
Windows: %INTREXX_HOME%/bin/windows/exportportal.bat
USAGE:
portalexport [options]
Options:
--destination=<destination> destination directory,
The default is <IntrexxDir>/export.
--format=<format> 's output format. Possible values are
, zip, tar, tgz, and plain.
The default format is zip.
--ignoreNoExport Ignore the .noexport flag in folders
--cleanMailConfig Clear mail configuration
--exportPassword Database passwords will be exported.
By default, no database passwords are exported.
--exportCredentialStore Exports the credentials store, including passwords.
By default, the credential store will be exported
without passwords.
--exportTrustStore The certificate store will be exported.
By default, the original credential store from the
blank portal will be exported.
--skipFiles Skip files in data groups
--optimize Use a speed-optimized data format
--compress Compress database exports
--verbose Verbose mode
--silent Silent mode
Portal Import
During a portal import, the "credentialstore.cfg" file is imported into the portal exactly as it appeared in the portal export. If any values are missing, a warning triangle is displayed next to the corresponding credential in the Credential Store. In addition, the Edit dialog box will indicate that the value is missing. You can reset your password there.
In element properties, credentials without a value are marked with the note "(no password)"—with the exception of generic elements and on the "Expert" tab.