Package com.chilkatsoft.chilkat2

Class Secrets

java.lang.Object
com.chilkatsoft.chilkat2.ChilkatObject
com.chilkatsoft.chilkat2.Secrets
All Implemented Interfaces:
AutoCloseable
public class Secrets extends ChilkatObject
<section class="secrets-summary">

Manage application secrets through one consistent API.

Chilkat.Secrets provides a unified interface for storing, retrieving, listing, and deleting secrets across local, cloud-based, and in-memory secret stores. It supports string, binary, and JSON secrets, making it useful for passwords, API keys, OAuth credentials, tokens, unlock codes, certificates, and private configuration data.

Local secure storage

  • Windows Credential Manager
  • Apple Keychain

Cloud secret managers

  • AWS Secrets Manager
  • Azure Key Vault
  • IBM Cloud Secrets Manager
  • Oracle Cloud Secrets
  • Doppler Secrets

Temporary secrets

Use in-memory secrets when values should exist only for the lifetime of the running process.

Flexible content types

Store and retrieve secrets as strings, binary data, or structured JSON.

Note: Cloud-based secret managers often require local bootstrap credentials. These can be stored securely in the Windows Credential Manager or Apple Keychain and then used to authenticate to the cloud secret manager.

Start with the Conceptual Overview and Components of a Secret Name. For an extended overview, see the Secrets Class Overview.

</section>

Event-capable: long-running methods report progress through a ProgressListener installed with setProgressListener(ProgressListener), onAbortCheck(BooleanSupplier), onPercentDone(IntPredicate) or onProgressInfo(BiConsumer).

Instances hold a native Chilkat object: close them with ChilkatObject.close() (try-with-resources) when done; an unclosed instance is freed when it becomes unreachable.

See Also:
Online reference

  • Constructor Details

    • Secrets

      public Secrets()
      Creates a new Secrets object.

  • Method Details

    • getAutoSplit

      public boolean getAutoSplit()
      The AutoSplit property is specific to local_manager secrets on Windows. The Windows Credentials Manager supports a maximum of 2560 bytes per secret. If a secret exceeds this size, it will be automatically compressed and split when created or updated, and automatically recomposed when retrieved.

      A secret can be split into a maximum of 10 parts.

      The default value is true.

      Returns:
      the value of the AutoSplit property

    • setAutoSplit

      public void setAutoSplit​(boolean value)
      Sets the AutoSplit property; see getAutoSplit().
      Parameters:
      value - the new value

    • getCompression

      public boolean getCompression()
      If set to true, then the contents of the secret will be stored compressed. The default value of this property is false.
      Returns:
      the value of the Compression property

    • setCompression

      public void setCompression​(boolean value)
      Sets the Compression property; see getCompression().
      Parameters:
      value - the new value

    • getLocation

      public String getLocation()
      The location of the secrets. Possible values are:
      • local_manager - On Windows this is the Credentials Manager. On MacOS and iOS it is the Keychain. This is not yet an option on Linux or Android.
      • aws_secrets_manager - AWS Secrets Manager
      • azure_key_vault - Azure Key Vault
      • ibm_cloud - IBM Cloud Secrets Manager
      • oracle_cloud - Oracle Cloud Secrets
      • doppler - Doppler Secrets
      • memory - In-Memory Secrets

      The default location is the local_manager. On Linux and Android, local_manager will behave the same as memory.

      Returns:
      the value of the Location property

    • setLocation

      public void setLocation​(String value)
      Sets the Location property; see getLocation().
      Parameters:
      value - the new value (not null)

    • getUncommonOptions

      public String getUncommonOptions()
      This is a catch-all property to be used for uncommon needs. This property defaults to the empty string and should typically remain empty.
      Returns:
      the value of the UncommonOptions property

    • setUncommonOptions

      public void setUncommonOptions​(String value)
      Sets the UncommonOptions property; see getUncommonOptions().
      Parameters:
      value - the new value (not null)

    • deleteSecret

      public void deleteSecret​(JsonObject jsonId)
      Deletes a secret. Cloud secrets managers will typically disable the secret and schedule the secret for deletion after some number of days.
      Parameters:
      jsonId - the jsonId argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getSecretBd

      public void getSecretBd​(JsonObject jsonId, BinData bd)
      Fetches a binary secret and returns the content in bd.
      Parameters:
      jsonId - the jsonId argument (not null)
      bd - the bd argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getSecretJson

      public void getSecretJson​(JsonObject jsonId, JsonObject jsonOut)
      Fetches a JSON secret and returns the content in jsonOut.
      Parameters:
      jsonId - the jsonId argument (not null)
      jsonOut - the jsonOut argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getSecretSb

      public void getSecretSb​(JsonObject jsonId, StringBuilder sb)
      Fetches a string secret and returns the content in sb.
      Parameters:
      jsonId - the jsonId argument (not null)
      sb - the sb argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • getSecretStr

      public String getSecretStr​(JsonObject jsonId)
      Fetches a string secret and returns the content of the secret.
      Parameters:
      jsonId - the jsonId argument (not null)
      Returns:
      the result (never null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • listSecrets

      public void listSecrets​(JsonObject json, JsonObject jsonOut)
      Lists secrets matching the wildcarded or exact values passed in json. The results of the query are returned in jsonOut.
      Parameters:
      json - the json argument (not null)
      jsonOut - the jsonOut argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • secretSpecToJson

      public void secretSpecToJson​(String secretSpec, JsonObject json)
      Converts a secret specification string (secretSpec) to JSON. A secret specification string is formatted as "!!part1|part2|part3|part4" where parts 3 and 4 are optional. json is the output argument.
      Parameters:
      secretSpec - the secretSpec argument (not null)
      json - the json argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setBootstrapSecret

      public void setBootstrapSecret​(JsonObject jsonId, Secrets secretContent)
      Accessing a cloud-based secrets manager requires authentication credentials, which cannot be stored in the manager itself. Instead, they must be securely stored locally.

      One solution is to store the authentication credentials as a secret in the Windows Credentials Manager or Apple Keychain. These credentials serve as the bootstrap secret for authenticating with the cloud-based secrets manager.

      jsonId contains the name of the bootstrap secret. secretContent contains the bootstrap's secret content.

      Parameters:
      jsonId - the jsonId argument (not null)
      secretContent - the secretContent argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • updateSecretBd

      public void updateSecretBd​(JsonObject jsonId, BinData secret)
      Creates a binary secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in jsonId, and the binary content of the secret in secret.
      Parameters:
      jsonId - the jsonId argument (not null)
      secret - the secret argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • updateSecretJson

      public void updateSecretJson​(JsonObject jsonId, JsonObject secret)
      Creates a JSON secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in jsonId, and the JSON content of the secret in secret.
      Parameters:
      jsonId - the jsonId argument (not null)
      secret - the secret argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • updateSecretSb

      public void updateSecretSb​(JsonObject jsonId, StringBuilder sb)
      Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in jsonId, and the string content of the secret in sb.
      Parameters:
      jsonId - the jsonId argument (not null)
      sb - the sb argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • updateSecretStr

      public void updateSecretStr​(JsonObject jsonId, String secret)
      Creates a string secret if it does not yet exist, or updates an existing secret. The name of the secret is specified in jsonId, and the string content of the secret in secret.

      Note: Starting in Chilkat v11.3.0, if the service = "Chilkat" and the username = "unlock_code", then the secret (which is the Chilkat unlock code) can be stored and retrieved without Chilkat being unlocked. This allows for the Chilkat unlock code itself to be persisted to a secrets manager.

      Parameters:
      jsonId - the jsonId argument (not null)
      secret - the secret argument (not null)
      Throws:
      ChilkatException - if the operation fails; ChilkatException.getLastErrorText() says why

    • setProgressListener

      public void setProgressListener​(ProgressListener listener)
      Installs the listener that receives this object's progress events (abortCheck, percentDone, progressInfo) during its long-running methods; replaces any listener or lambda installed before; null removes it.
      Parameters:
      listener - the listener, or null
      Throws:
      IllegalStateException - if called from inside one of this object's own callbacks

    • getProgressListener

      public ProgressListener getProgressListener()
      Returns the installed listener, or null.
      Returns:
      the listener installed with setProgressListener(ProgressListener) or one of the on... methods

    • onAbortCheck

      public void onAbortCheck​(BooleanSupplier callback)
      Installs a listener whose only callback is abortCheck: called every HeartbeatMs milliseconds during a long-running method; return true to abort it. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener

    • onPercentDone

      public void onPercentDone​(IntPredicate callback)
      Installs a listener whose only callback is percentDone: called with the completion percentage (0..100) as a long-running method progresses; return true to abort it. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener

    • onProgressInfo

      public void onProgressInfo​(BiConsumer<String,​String> callback)
      Installs a listener whose only callback is progressInfo: called with a name/value pair of progress information as a long-running method proceeds. Replaces any listener installed before.
      Parameters:
      callback - the callback, or null to remove the listener