Framework Web Tools



  • Encrypt Value

Active Secret Provider: FileBasedSecretProvider (no vault configured) — Reachable

Active Configuration

Lookup markerLOOKUP
Cache TTL (seconds)300
Retry count2
Retry delay (ms)500
Master key env varOFBIZ_MASTER_KEY
PBKDF2 iterations310000

View Secret Audit Log

Encrypt a secret value with AES-256-GCM (using the server's OFBIZ_MASTER_KEY) and store the result either in a SystemProperty record or in framework/base/config/passwords.properties. The encrypted value is not displayed. If the target SystemProperty record or passwords.properties entry already exists, it is updated with the new encrypted value; otherwise it is created.

  • For SystemProperty: Resource ID and Property ID are required. Lookup Key is optional.
  • For passwords.properties: Lookup Key is always required. Leave Resource ID and Property ID empty to write only to passwords.properties (entityengine.xml jdbc-password-lookup use-case). Provide all four fields to also update the matching property file on disk (sets <propertyId>=LOOKUP(<lookupKey>)) and refresh the in-memory property cache — no server restart needed.
Required for passwords.properties. When Resource ID and Property ID are empty, stored as jdbc-password.<lookupKey> (entityengine.xml use-case). When all four fields are provided, stored as <lookupKey> directly (property file use-case). Optional for SystemProperty: if set, the plain key is stored in systemPropertyLookup so a configured remote secret provider is tried first.

Or upload a CSV file to create multiple secrets at once:

  • Columns (header row required): target, systemResourceId, systemPropertyId, lookupKey, secretValue
  • target is SYSTEM_PROPERTY or PASSWORDS_FILE; leave unused columns empty

Force an immediate re-fetch from the secret provider by flushing all cached values. Use this after rotating a secret so the new value is picked up without restarting OFBiz.

Re-discover the active secret provider via ServiceLoader. Use this after deploying a new vault plugin jar or editing that plugin's own connection settings, without restarting OFBiz.

Fetch the current value of a key from the active secret provider and re-encrypt it into the local fallback snapshot. Use this after rotating a secret in the remote vault to keep the local ENC(...) fallback (used when the vault is unreachable) up to date.

Verify that the active secret provider is reachable by resolving a known key. If the key exists the secret value is confirmed but never displayed. A "key not found" response still confirms vault connectivity.

Secret lookup statistics since the last JVM start. Hit = served from cache; Miss = fetched from provider.

Cache Hits: 0  |  Provider Fetches: 0  |  Total Lookups: 0  |  Keys In Cache: 0   View full stats