What is the recommended way to store API credentials in EPiServer?

Vote:
 

I have an external API that I need to connect to from EPiServer, which requires a username and password. I want to make the credentials editable by administrators, so hard-coding or putting in a web.config is not an option. I was considering storing them as properties on the start page with a masked textbox like this post discusses:
https://world.episerver.com/forum/developer-forum/-Episerver-75-CMS/Thread-Container/2016/5/password-field-in-start-page-settings/ 

Although that one gives me pause because the actual password can be read by viewing the source of the page. I am looking for any other potential solutions that would allow me to store them somewhere securely, maybe in azure key vault. Has anyone else done this before?

#206018
Aug 01, 2019 0:02
Vote:
 

Hi Jason, 

The problem you described is exactly what Azure Key Vault is designed to solve. I have used it and can highly recommend it. 

If you're ready to give it a go, here are the two C# examples I used to get started;

If you're not very familiar with Azure Key Vault, here are some additional resources;

I'd love to hear how you got on.

#206019
Edited, Aug 01, 2019 2:05
Vote:
 

This isn't really an Episerver question, but more of a standard .Net question.

I wouldn't have them as properties on a start page. You don't want to expose infrastructure related configurations to content admins - that's not what a CMS is for.

You have a few options, and it really depends on the tooling you have in place.

For example, I've always delegated configuration transforms to the continious integration build pipeline we have in place. We use Octopus Deploy, so it's relatively straightforward to set up a transform which swaps out configuration items with "variables" stored in Octopus prior to deploying a package. 

But you might be using something different like Azure DevOps or similar - most industry standard CI/CD tooling software will ship with something that will allow you to achieve this. 

#206066
Edited, Aug 01, 2019 16:23
Vote:
 

We also use config transforms for environment settings.

I guess the part of @jason's original post that relates to Episerver is where he says I want to make the credentials editable by administrators.

You could provide them access to the Azure Portal to manage Azure Key Vault secrets, but that could be hard to manage, so I'd suggest using it's API (Nuget) to build the Admin UI inside Episerver, either in a specific settings page (Events) or as a Module (🤔 I quite like the Module approach but its a lot more work).

#206074
Edited, Aug 01, 2019 23:42
Vote:
 

There are several ways to store config inside Epi without exposing it to regular editors (which I agree is NOT recommended). 

If config transformation is not necessary for your credentials, you could always hide your settings away in admin mode as plugin config (via Plug-in Manager).

I wrote a blog post a few years back about several options to store config: https://www.epinova.no/en/blog/configuration-options-for-episerver-sites/

#206098
Aug 02, 2019 10:02
Vote:
 

Thanks for all the good feedback guys. It really helps me make an informed decision.

#206117
Aug 02, 2019 16:57
Vote:
 

I also wanted to add I found another option that others may consider. If you are running in the DXC like we are, the azure application for your site has a section for configuration. You can add configuration key/value pairs there that you can read at runtime as if they exist in your web.config in the appSettings section. They are store encrypted in azure and can be managed administratively in integration manually, but prep and prod require you to submit a ticket to support create them. We like this option the best because it was such a minimal setup and code to accomplish the same goals. Thanks for your help guys.

#206371
Aug 16, 2019 16:32
This topic was created over six months ago and has been resolved. If you have a similar question, please create a new topic and refer to this one.
* You are NOT allowed to include any hyperlinks in the post because your account hasn't associated to your company. User profile should be updated.