← Back to plugin index

Cipher User Persister
Description

Encrypts and decrypts selected fields of user data. Uses an underlying other user persister plugin to load and store data, i.e. it is applicable to any other user persister plugin.

The method changeUsername(String oldUsername, String newUsername) is not implemented and will throw a NotImplementedException.

Note that data that is not (yet) encrypted can be read as plaintext. The first time the field is written (because of a change in the very field itself), it will be encrypted. This makes migration of data and mixture with encrypted and non-encrypted data possible. It also implies that this encryption provides secrecy (confidentiality) but no authenticity!

The following restrictions apply when using data field encryption:

  • Encryption can only be applied to context data fields.
  • Encryption can only be applied to string type fields.
  • Encryption cannot be applied to the username (even if part of the context data container)
  • Searching on encrypted fields is not supported.
  • If encrypting a context data property that is also used by other persister plugins (e.g. a credential persister plugin), make sure that the other plugin also encrypts the field.
  • Note that encrypted strings are larger than their plain counterpart. Make sure to allow long strings in the underlying persister plugin. The shortest encrypted string is 38 characters long. For longer strings, doubling the plain string length makes a good upper boundary but some encryption mechanisms will still produce much longer output.

Type name
CipherUserPersister
Class
com.airlock.iam.core.misc.impl.persistency.cipher.CipherUserPersister
May be used by
Email User Profile Item Combining User Persister Email Notification Task Email Notification Task Destroy Last User Session Lock Expired Initial Passwords Task Lock Expired Initial Passwords Task Custom User Persister-based User Store Provider Delete Users Task Delete Users Task User Persister-based User Store Meta Authenticator Email Notifier Self Reg Users Clean Up Task Self Reg Users Clean Up Task User to Password Service Mapping Extended User Persister-based User Store Provider New Email Clean-up Strategy Vasco Letter Generator User Persister Email Certificate Provider Password Batch Task Password Batch Task HTTP Password Service Self Reg Users Reminder Task Self Reg Users Reminder Task Certificate Authenticator Combining Extended User Persister Combining Extended User Persister User Persister Configuration User Persister Configuration User Persister Configuration String User Profile Item Lock Inactive Accounts Task Lock Inactive Accounts Task Token Activation On Delivery Strategy Password Authenticator Selection Authenticator Main Authenticator Auth Method-based Authenticator Selector Extended String User Profile Item Certificate Token Authenticator Integer User Profile Item Radius Authentication Service Lookup and Accept Authenticator SMS Notifier Role-based Authenticator Selector Export Users Task Export Users Task Airlock 2FA Authenticator Credential Data Certificate Matcher
License-Tags
DataEncryption
Properties
User Persister (userPersister)
Description
The underlying persister plugin used to load and store data.
Attributes
Plugin-Link
Mandatory
Assignable plugins
Cipher User Persister Combining Extended User Persister Database User Persister Dummy Extended User Persister LDAP Connector LDAP User Persister Property User Persister
Encrypted Context Properties (encryptedContextProperties)
Description

Specifies a list of names of string context data properties that have to be stored encrypted on the database.

Attributes
String-List
Mandatory
Cipher Password (cipherPassword)
Description

Password used for the encryption and decryption.

If other persister plugins (e.g. a CredentialPersister plugin) also use encryption on context data fields listed in this plugin, make sure they use the same password.

This property supports the extended string syntax, i.e. its value may be configured scrambled or in an external file (see example values).

Attributes
String
Mandatory
Sensitive
YAML Template (with default values) 

type: CipherUserPersister
id: CipherUserPersister-xxxxxx
displayName: 
comment: 
properties:
  cipherPassword:
  encryptedContextProperties:
  userPersister: