How to configure and use secure properties in Mule 4?
Secure Property is a very unique way of keeping our sensitive data like Client Id and Client Password secure (encrypted/cipher-text) in the mule property file. We can use .yaml or .properties file to achieve this.Generally in properties files we store information like Client id, Secret, User Id, User Password, Splunk Tokens, Oauth Token, AWS Keys etc.
We need to encrypt the data inside any property files to restrict unauthorised access and to protect the data.
Let’s discuss how to achieve this using MuleSoft’s Secure Property Placeholder.
To create secure configuration properties, review the following steps:
Step- 1: Create a configuration properties file.
Step- 2: We can encrypt the whole file or encrypt individual property. For individual property, we can define secure properties in the file by enclosing the encrypted values between the sequence ![value].
Step- 3: Configure the file in the project with the Mule Secure Configuration Properties Extension module dependency. The file must point to or include the decryption key.
Create a Configuration Properties File
The first task in securing configuration properties is to create a Yaml configuration file (.yaml) or a Spring-formatted Properties file (.properties), where you define the properties in src/main/resources in your Mule project.The Mule Secure Configuration Properties extension module enables you to configure Yaml or Properties file types.
Refer to the below artefacts for more information-
Open Anypoint Studio -> Go to Project Folder -> src/main/resources ->Select Create New file(File extension can be either .yaml or .properties)
How to define Secure Configuration Properties in the File
1.Adding the Premium Security Connector in AnyPoint Studio:
Open Anypoint Studio -> Go to Help -> Select Install New Software and Click the Add button and it will open a window,provide Name as: Anypoint Enterprise Security and provide location as: http://security-update-site-1.4.s3.amazonaws.com and press OK.
Go to the work drop down and check Anypoint Enterprise Security — http://security-update-site-1.4.s3.amazonaws.com in the dropdown list.Select it and select the Premium checkbox -> click Next — accept policy and finish.
Now go to application and right click on dev.properties and go to -> Open with -> Mule Properties Editor.Now your property file is open in table editor view.
Double click on any key. It will open a new window.Now press the button Encrypt. In the next window specify the ‘algorithm’ (Algorithm used to encrypt/decrypt the value example- AES, Blowfish) and provide an encryption key(key size must be at least : ‘16’ if it is AES algorithm) to encrypt.Press the OK button.
Similarly you can encrypt the rest of the properties and open the file with a text editor.
***Note: We can not encrypt the yaml file this way as after the encryption process all the property key alignment will be rearranged. ***
But encryption of Yaml file can be achieved using Java encryption JAR
2.Encrypt Properties Using the Secure Properties Tool(jar)
Download Secure-properties-tool.jar and put it into any folder location. Put the un-encrypted yaml file in the same location.
Use the following syntax to encrypt or decrypt all the content of a properties file:
String level
java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool string <operation><algorithm><mode><key><input property>
java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool string encrypt Blowfish CBC 123456789 PriyankaPaul
File/file level — — — —
java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool <method><operation><algorithm><mode><key><input file><output file>
java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool file encrypt AES CBC 1234567812345678 dev-properties.yaml dev-out.yaml
Example of file encryption :
Final step is configuring secure property module and dependency in project
Add the secure property module in your project and configure the same.It can be downloaded from exchange also
Maven dependency :
<dependency><groupId>com.mulesoft.modules</groupId><artifactId>mule-secure-configuration-property-module</artifactId><classifier>mule-plugin</classifier><version>1.0.0</version></dependency>
File : Property file name
Key: encryption /decryption key. This token will be passed in runtime configuration as program argument example : -Dtoken=1234567812345678
Define the correct Algorithm and mode used for encryption.
Use of secure property in project
In any global configuration you can use this secure property as ${secure:: property.name}. In dwl we can also use secure property as p(‘secure:: property.name’)
In this below example we used HTTP port as ${secure:: http.port} and decrypted_username_value: p(‘secure::username’)
Please note, the decryption process will be done implicitly by the Mule Runtime engine and this requires only the Key (passed as VM argument) which was used to encrypt the Password and Voila You’re Done!!!!
Thank you :)
