Defined masked/secret plugin setting

IdentityIQ (IIQ) IIQ Discussion and Questions
,
1

Which IIQ version are you inquiring about?

8.3

Please share any images or screenshots, if relevant.

image
image1905×206 6.59 KB

Share all details about your problem, including any error messages you may have received.

I’m developing an IIQ plugin. In my manifest file, I have the following settings:

<List>
            <Setting
                    dataType="string"
                    helpText="Client ID for the Orchid API, as provided by the Orchid team."
                    label="Client ID"
                    name="clientId"/>
            <Setting
                    dataType="string"
                    helpText="Client secret for the Orchid API, as provided by the Orchid team."
                    label="Client Secret"
                    name="clientSecret"/>
</List>

Is there a way to mask/hide the inserted value in the UI after saving it? For sensitive values like passwords, client secrets, etc…

Another option I considered is creating a dedicated UI page to store the configurations in the DB, but I prefer using the existing settings mechanism.

2

Hi Liza - Try using obscure="true"

3

You’ll want to just encrypt your string and store the encrypted value. Then in your code just call decrypt on that string setting value. I’ve sometimes just used custom objects or even system configuration which is cached and easy to get to for storing plugin settings too so they can be tokenized if you are using the SSB.

4

Hey, thank you for the suggestion!

When adding obscure="true", rebuilding and then uploading the plunging, I’m getting an error saying Unable to process manifest file in OrchidSecurityPlugin.1.0.0.zip

When looking at sailpoint.dtdI don’t see an obscure option in the Setting element.

5

Hi Liza - I can’t find any documented options to do this the way that you’d like to. Have you considered Paul’s suggestion? (Thanks Paul!)

6

Hey, regarding encrypting the value:

  1. Assuming you’re referring to the encrypt command of the IIQ console, I don’t want to be coupled to the client having console access upon plugin installation and configuration.
  2. Assuming you’re suggesting some custom encryption mechanism, we would like to avoid it since the decryption code will be available in the plugin zip and can be exploited.

Please let me know if I’m missing something. I mainly would like to avoid creating a dedicated UI page.

7

Not having console access is fine. There are plenty of ways to encrypt strings and have them be stored in objects.

8

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.