Any secret vault service in IBM-i

[deep]

Hello

Are you aware if there is any vault or secret manager service in IBM-i to store secrets like API key/client secret etc.?? Any direction/suggestion would be greatly appreciated.

Regards, Deep

[JonBoy]

There is to my knowledge no specific tool for this purpose. Most people I suspect would use Db2's row/column encryption capability and simply store such information in a table.

[Vectorspace]

I did something like this recently, though instead of using row/column encryption I used the ENCRYPT_AES() and DECRYPT_BIT() SQL functions to do the encryption myself.

If you do build one, you should definitely do some reading up on best practices. It is not as simple as just encrypting or hashing the password and storing the result.
For example you shouldn't simply encrypt and store the password with some global encryption key, else 2 users with the same password also have the same encrypted password - which is very bad practice, and can make brute-forcing much easier. The password should be combined with some large, random-per-password value (salt) before encrypting/hashing to ensure the encrypted value is different for each entry.

https://www.ibm.com/docs/en/i/7.3?topic=functions-encrypt-aes

https://www.ibm.com/docs/en/i/7.3?topic=sf-decrypt-bit-decrypt-binary-decrypt-char-decrypt-db

[deep]

Vectorspace , If I may ask, encrypt_aes() function needs a password. Now that password also needs to be stored somewhere if a batch application is using it. How are you storing that password??

[Vectorspace]

We aren't, exactly.

What we have built is a simple user password system for an API. We generate a new password, and use it to encrypt the random salt value, which is also stored. When the user logs in with that password, we text to see if it encrypts the salt to the same encrypted value.

So rather than storing the password itself, we store a value that was encrypted with the password