The Secrets vault keeps the passwords, keys and other sensitive values that Portail ZAPP needs to connect to other systems. The screens that need them never store the value: they designate a secret by its name, and the value is only read when it is used. This is the case, among others, of:
- Active Directory sync: the password of the bind account;
- Intune connector and Ivanti UEM connector: the client secret or the service account password;
- Network inventory: the passwords, communities and keys of credentials;
- Script runner: a script quotes a secret as
{{secret:name}}.
The Secrets screen (menu Administration › Connectors and automation › Secrets) is reserved for Administrators.
The secret list
The list shows each secret's Name and the date of its last change (Updated at). A saved value is never displayed again, here or anywhere else: keep the original in your own password manager if you need to be able to read it back.
Create a secret
+ New secret asks for:
- Name: unique and final (a secret cannot be renamed). Choose a meaningful name, for example
ad-bindorintune.client-secret. For a script to be able to quote it, only use unaccented letters, digits,_,.and-, with no spaces; - Value: the sensitive value, typed hidden.
The value is encrypted with the instance's encryption key. If that key is not configured (see the warning on the Configuration screen), no secret can be saved. The message "Error creating secret." appears in that case, and also when the name is already taken.
Replace a value
When a password changes, click Replace value, type the new value, then Save. The modules that use this secret pick up the new value the next time they use it: nothing else to change.
Delete a secret
Delete erases the secret immediately, without confirmation, and without checking whether it is still in use. The screens that designate it keep its name: their connections then fail (secret not found) until you recreate a secret with the same name or choose another one. So check that no rule, source or credential uses it before deleting it.
See also
- "Synchronizing the Active Directory", "Microsoft Intune connector", "Ivanti UEM connector" and "Managing network inventory access and approvals": the screens that designate a secret.