Skip to main content

Managed secrets

A managed secret is a credential the directory stores on your behalf, encrypted at rest. Connector configuration and identity provider records reference managed secrets rather than holding credentials themselves, so a credential is written once and never returned in a read.

Where to find them​

In the console, go to Managed secrets. Over REST the collection is /v1/managed-secrets.

The list shows each secret's name and when it was last updated. Values are never displayed and never returned by the API. To change a credential you replace the value; to find out what a value currently is, go to the system that issued it.

How they are protected​

Each secret's value is encrypted with its own data key, and that data key is itself encrypted with a key-encryption key held in a Kubernetes Secret rather than in the database. Both layers use AES-256.

The practical consequence: a copy of the database alone does not yield the credentials. Recovering them requires the key-encryption key as well, which lives in a different place with different access controls.

Rotating the key-encryption key​

The key-encryption key is versioned. Its Kubernetes Secret holds a map of version number to key, and the highest version present is the one used to encrypt new values:

{
  "1": "<BASE64_KEY_V1>",
  "2": "<BASE64_KEY_V2>"
}

To rotate, add a new highest-numbered entry and keep the old ones. Existing secrets record which version protected them, so old entries are still needed to read them. Removing a version makes every value encrypted under it unreadable.

Each key must be exactly 32 bytes before base64 encoding. A shorter key is accepted by the underlying cipher at a weaker strength rather than rejected, which is why the platform checks the length itself and refuses to start on a mismatch instead of silently downgrading.

Keys are read once at startup, so a rotation takes effect when the directory restarts, matching how the rest of its configuration reloads.

Re-encrypting after rotation​

Adding a new version does not rewrite existing secrets. They stay under their original version until their values are next written, at which point they pick up the current key. To move a specific credential onto the new key immediately, update its value.

Next steps​