README

凭据存储

后端

此API支持以下后端

• 文件
• 环境变量
• HashiCorp的Vault
• KeePass数据库
• Docker Secrets

文件

通过FromFile类。预期文件具有以下格式

rest_password=abcdefg
ldap_password=qwertzu

环境变量

通过FromEnvironment类。凭据名称通过将它们转换为大写并用两个下划线替换正斜杠来映射到环境变量

use security\credentials\{Credentials, FromEnvironment};

$credentials= new Credentials(new FromEnvironment());
$secret= $credentials->named('ldap_password');     // Reads $ENV{LDAP_PASSWORD} => util.Secret

HashiCorp的Vault

通过FromVault类。凭据从挂载在/secret的后端读取。

use security\credentials\{Credentials, FromVault};

// Set token to NULL to use VAULT_TOKEN from environment
$token= new Secret('72698676-4988-94a4-...');

$credentials= new Credentials(new FromVault('http://127.0.0.1:8200', $token));
$secret= $credentials->named('ldap_password');     // Reads ldap_password key from /secret

$credentials= new Credentials(new FromVault('http://127.0.0.1:8200', $token, 'vendor/name'));
$secret= $credentials->named('mysql');             // Reads mysql key from /secret/vendor/name

KeePass数据库

通过KeePass类。

use security\credentials\{Credentials, FromKeePass};
use util\Secret;

$secret= new Secret('key');

$credentials= new Credentials(new FromKeePass('database.kdbx', $secret));
$secret= $credentials->named('ldap_password');     // Reads top-level entry ldap_password

$credentials= new Credentials(new FromKeePass('database.kdbx', $secret, 'vendor/name'));
$secret= $credentials->named('mysql');             // Reads mysql entry in vendor/name subfolder

Docker secrets

请参阅https://docs.docker.net.cn/engine/swarm/secrets/。如果未传递参数，则在Windows和Un*x系统上使用Docker的默认位置。

use security\credentials\{Credentials, FromDockerSecrets};
use util\Secret;

$credentials= new Credentials(new FromDockerSecrets());
$secret= $credentials->named('ldap_password');     // Reads top-level entry ldap_password

另请参阅

xp-framework/rfc#316