Role Mapper - sensitive data in oidc-config

[arnmohan]

Environment Details

• Helidon Version: 3.2.8
• Helidon SE or Helidon MP: Helidon MP
• JDK version: JDK 17

---

Problem Description

Role Mapper is currently using IDCS client secret from oidc-config which is sensitive data .

oidc-config:
client-id: "client-id"
client-secret: " ***** "
identity-uri: "IDCS identity server address"

We need to ensure sensitive data in OIDC config could potentially come from Vault (i.e., if oidc-config is an OCID to vault-secret then resolve it from OCI)

[arjav-desai]

You can encrypt config values, please see section "encryption" under https://helidon.io/docs/latest/mp/config/introduction and https://helidon.io/docs/latest/mp/security/configuration-secrets

[arnmohan]

security.config:

require-encryption: false
aes.insecure-passphrase: "myMasterPasswordForEncryption"
rsa:
keystore:
# load from classpath
resource.resource-path: ".ssh/keystore.p12"
# If keystore is used, alias to use from the keystore (in this example, it is "1")
key.alias: "1"
# Password of keystore
passphrase: "helidon"

In this example, do we need a file to keep the encryption key ? if so where do we store file