Plugins various secret managers - AWS Secrets Manager, GCP(Google Cloud Platform) Secret Manager, Azure Key Vault, HashiCorp Vault by IBM, 1Password, and Bitwarden Secrets Manager.

.github/dependabot.yml

@@ -23,11 +23,17 @@ updates:
   - package-ecosystem: "gradle"
     directories:
       - "/ai-agent-skills"
+      - "/aws-secrets-provider"
+      - "/azure-keyvault-secrets-provider"
       - "/birt"
+      - "/bitwarden-secrets-provider"
       - "/example"
       - "/firstdatapaymentgateway"
+      - "/gcp-secretmanager-secrets-provider"
+      - "/hashicorp-vault-secrets-provider"
       - "/ldap"
       - "/lucene"
+      - "/onepassword-secrets-provider"
       - "/pricat"
     schedule:
       interval: "daily"

secretshub/build.gradle

@@ -0,0 +1,63 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+// Combined dependencies for all 7 bundled SecretProvider implementations.
+// Only the provider selected via secret.provider.active in secretshub.properties
+// is ever constructed at runtime (see ActiveSecretProvider), but all 7 SDKs must
+// be on the classpath at build time since any one of them may be chosen.
+//
+// AWS SDK for Java v2 — Apache License 2.0 — https://github.com/aws/aws-sdk-java-v2
+// Azure SDK for Java — Key Vault Secrets (MIT License) — https://github.com/Azure/azure-sdk-for-java
+// Google Cloud Secret Manager Java client (Apache License 2.0) — https://github.com/googleapis/java-secretmanager
+// HashiCorp Vault Java Driver — Apache License 2.0 — https://github.com/jopenlibs/vault-java-driver
+//
+// Bitwarden, env-var, and 1Password contribute no third-party dependencies here —
+// JDK java.net.http.HttpClient only.
+dependencies {
+    pluginLibsCompile 'software.amazon.awssdk:secretsmanager:2.26.31'
+    pluginLibsCompile 'software.amazon.awssdk:url-connection-client:2.26.31'
+
+    pluginLibsCompile 'com.azure:azure-security-keyvault-secrets:4.8.0'
+    pluginLibsCompile 'com.azure:azure-identity:1.12.0'
+    // Azure's HTTP client (azure-core-http-netty / reactor-netty) lists io.netty:netty-tcnative-boringssl-static
+    // as an OPTIONAL transitive dependency, so Gradle never downloads it and Netty falls back to the plain JDK
+    // SSLEngine for TLS. That fallback is functionally correct (confirmed against a real Azure Key Vault) — the
+    // only effect of its absence is losing OpenSSL-accelerated TLS throughput, which only matters at production
+    // scale, not for local development. Netty logs the missing-library fallback at DEBUG (see the io.netty /
+    // reactor / com.azure logger entries in framework/base/config/log4j2.xml); it is not an error.
+    // To opt in to native TLS acceleration, uncomment the line below. The version is already pinned by the
+    // existing dependency graph (see `./gradlew dependencies -p plugins/secretshub`), so no version guesswork is
+    // needed; it resolves to the same "uber" jar bundling native binaries for linux-x86_64, linux-aarch_64,
+    // osx-x86_64, osx-aarch_64, and windows-x86_64, so it stays portable across dev machines. Regenerate the
+    // lockfile after uncommenting (rm gradle.lockfile && ./gradlew :plugins:secretshub:dependencies --write-locks).
+    // pluginLibsRuntime 'io.netty:netty-tcnative-boringssl-static:2.0.65.Final'
+
+    pluginLibsCompile 'com.google.cloud:google-cloud-secretmanager:2.36.0'
+
+    pluginLibsCompile 'io.github.jopenlibs:vault-java-driver:5.4.0'
+}
+
+// AWS SDK v2 and others bundle several items that conflict with OFBiz's global exclusions
+configurations.all {
+    exclude group: 'commons-logging', module: 'commons-logging'
+}
+
+dependencyLocking {
+    lockAllConfigurations()
+}

secretshub/config/aws-secrets-manager.properties

@@ -0,0 +1,79 @@
+###############################################################################
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+###############################################################################
+
+####
+# AWS Secrets Manager — SecretProvider configuration
+#
+# Authentication:
+#   - If both aws.secretsmanager.access.key.id and aws.secretsmanager.secret.access.key
+#     are set below, those static credentials are used.
+#   - Otherwise, the AWS Default Credential Provider Chain is used:
+#       1. Environment variables: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY
+#       2. Java system properties: aws.accessKeyId / aws.secretAccessKey
+#       3. AWS credential profiles file (~/.aws/credentials)
+#       4. EC2 / ECS instance profile / IAM role (recommended for production)
+#       5. AWS SSO
+####
+
+# AWS region for the Secrets Manager endpoint.
+# Leave empty to let the SDK resolve from the environment (recommended for EC2/ECS).
+aws.secretsmanager.region=us-east-1
+
+# Optional static credentials. Leave both empty to use the AWS Default Credential
+# Provider Chain (recommended for EC2/ECS/EKS via instance/task IAM roles).
+# aws.secretsmanager.secret.access.key may be encrypted with ENC(...), see
+# ConfigCryptoUtil and the encryptDbPassword Gradle task.
+aws.secretsmanager.access.key.id=
+aws.secretsmanager.secret.access.key=
+
+# How long (in seconds) to cache a resolved secret value in memory before re-fetching.
+# Default: 3600 (1 hour). Set to 0 to disable caching (not recommended in production).
+aws.secretsmanager.cache.ttl.seconds=3600
+
+# Optional prefix prepended to every OFBiz secret key before the AWS lookup.
+# Example: with prefix "myapp/prod/" the key "jdbc-password.ofbiz" becomes
+#          "myapp/prod/jdbc-password.ofbiz" in AWS Secrets Manager.
+aws.secretsmanager.secret.name.prefix=
+
+# If the secret in AWS is a JSON object (e.g. {"password":"s3cr3t","username":"dbuser"}),
+# set this to the field name that holds the actual secret value (e.g. "password").
+# Leave empty to use the raw secret string as-is.
+aws.secretsmanager.json.field=
+
+# Optional endpoint override. Useful for local testing with LocalStack.
+# Example: http://localhost:4566
+aws.secretsmanager.endpoint.override=
+
+# If AWS Secrets Manager is unreachable (e.g. outage, network issue), fall back to
+# the value configured for the same key in framework/base/config/passwords.properties.
+# A warning is logged whenever this fallback is used. Values in passwords.properties
+# may be encrypted with ENC(...), see ConfigCryptoUtil and the encryptDbPassword
+# Gradle task.
+# Default: true
+aws.secretsmanager.fallback.enabled=true
+
+# Optional per-key overrides for deployments where the OFBiz logical secret key
+# (e.g. "jdbc-password.mysql-ofbiz", documented in SECRET_KEYS.md) cannot be stored
+# verbatim as the AWS Secrets Manager secret name (e.g. naming restrictions in a
+# given AWS account/region setup). The logical key on the left never changes; only
+# the AWS-side secret name on the right needs to satisfy AWS's naming rules.
+# Format: key.alias.<logicalKey>=<awsSecretName>
+# Example:
+# key.alias.jdbc-password.mysql-ofbiz=prod/ofbiz/mysql_db_password
+# Leave unset (the default) for keys that AWS will accept verbatim.

secretshub/config/azure-keyvault.properties

@@ -0,0 +1,56 @@
+###############################################################################
+# Azure Key Vault — SecretProvider configuration
+#
+# To activate this provider:
+#   1. Set enabled="true" in azure-keyvault-secrets-provider/ofbiz-component.xml
+#   2. Set enabled="false" on every other *-secrets-provider plugin
+###############################################################################
+
+# Full URL of your Azure Key Vault (required)
+# Example: https://my-vault.vault.azure.net
+azure.keyvault.url=
+
+# Authentication method:
+#   default       — Uses DefaultAzureCredential: tries Managed Identity, env vars,
+#                   Azure CLI, Visual Studio Code, etc. in order. Recommended for
+#                   Azure-hosted deployments (AKS, App Service, VMs with Managed Identity).
+#   client_secret — Authenticates as a service principal using tenant + client credentials.
+#                   Use for on-premise or non-Azure deployments.
+azure.auth.method=default
+
+# Required only when azure.auth.method=client_secret
+azure.tenant.id=
+azure.client.id=
+azure.client.secret=
+
+# Optional prefix prepended to every secret name before lookup.
+# Example: "prod-" makes key "db" → "prod-db"
+azure.secret.name.prefix=
+
+# Azure Key Vault secret names may only contain letters, digits and hyphens.
+# OFBiz keys like "jdbc-password.mysql-ofbiz" contain a dot, which is invalid.
+# Set this to the replacement character (default: -) so the dot is substituted.
+# Example: "jdbc-password.mysql-ofbiz" → "jdbc-password-mysql-ofbiz"
+# Set to empty to disable replacement (only do this if your keys have no dots).
+azure.secret.name.dot.replacement=-
+
+# Optional per-key overrides for keys where the dot-replacement convention above still
+# doesn't produce an acceptable Azure Key Vault secret name. The logical key on the left
+# never changes; only the Azure-side secret name on the right needs to satisfy Azure's
+# naming rules. Checked before dot-replacement is applied.
+# Format: key.alias.<logicalKey>=<azureSecretName>
+# Example:
+# key.alias.jdbc-password.mysql-ofbiz=prod-ofbiz-mysql-db-password
+# Leave unset (the default) for keys the dot-replacement convention already handles.
+
+# In-memory cache TTL in seconds (default: 3600 = 1 hour).
+# Set to 0 to disable caching (fetches from Azure on every call).
+azure.cache.ttl.seconds=3600
+
+# If Azure Key Vault is unreachable (e.g. outage, network issue), fall back to
+# the value configured for the same key in framework/base/config/passwords.properties.
+# A warning is logged whenever this fallback is used. Values in passwords.properties
+# may be encrypted with ENC(...), see ConfigCryptoUtil and the encryptDbPassword
+# Gradle task.
+# Default: true
+azure.fallback.enabled=true

secretshub/config/bitwarden-secrets.properties

@@ -0,0 +1,75 @@
+###############################################################################
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+###############################################################################
+
+####
+# Bitwarden Secrets Manager — SecretProvider configuration
+#
+# Requires a Bitwarden Secrets Manager machine account access token.
+# Create one in the Bitwarden SM console under Machine Accounts.
+#
+# The access token embeds an AES-256 symmetric key used to decrypt
+# secret names and values client-side (end-to-end encryption).
+#
+# NOTE: Only ONE SecretProvider plugin may be active at a time.
+# Deploy only the plugin that matches your environment.
+####
+
+# Bitwarden Secrets Manager REST API base URL.
+# Use https://api.bitwarden.eu for EU cloud, or your self-hosted URL.
+bitwarden.api.url=https://api.bitwarden.com
+
+# Bitwarden Identity Service URL (used for machine account OAuth token exchange).
+bitwarden.identity.url=https://identity.bitwarden.com
+
+# Machine account access token.
+# Format:  0.<serviceAccountId>.<clientSecret>:<base64EncKey>
+# Inject at deploy time — do not commit a real token.
+bitwarden.access.token=
+
+# UUID of the organization that owns the secrets.
+bitwarden.organization.id=
+
+# Optional prefix prepended to the OFBiz key when matching the Bitwarden secret key (name).
+# Example: with prefix "myapp/" the OFBiz key "jdbc-password.ofbiz" matches a
+#          Bitwarden secret whose decrypted key is "myapp/jdbc-password.ofbiz".
+bitwarden.secret.name.prefix=
+
+# Optional per-key overrides for deployments where a specific key needs to match a
+# Bitwarden secret title that differs from the OFBiz logical key. The logical key on the
+# left never changes; only the secret title on the right needs to match what's in Bitwarden.
+# Format: key.alias.<logicalKey>=<secretTitle>
+# Example:
+# key.alias.jdbc-password.mysql-ofbiz=prod-ofbiz-mysql-db-password
+# Leave unset (the default) for keys whose title matches the logical key verbatim.
+
+# How long (in seconds) to cache resolved secret values before re-fetching.
+# Default: 3600 (1 hour). Set to 0 to disable caching.
+bitwarden.cache.ttl.seconds=3600
+
+# HTTP connect and read timeouts in seconds.
+bitwarden.connect.timeout.seconds=5
+bitwarden.read.timeout.seconds=10
+
+# If Bitwarden Secrets Manager is unreachable (e.g. outage, network issue), fall back
+# to the value configured for the same key in framework/base/config/passwords.properties.
+# A warning is logged whenever this fallback is used. Values in passwords.properties
+# may be encrypted with ENC(...), see ConfigCryptoUtil and the encryptDbPassword
+# Gradle task.
+# Default: true
+bitwarden.fallback.enabled=true

secretshub/config/env-var-secrets.properties

@@ -0,0 +1,64 @@
+###############################################################################
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+###############################################################################
+
+####
+# Environment Variable SecretProvider configuration
+#
+# Resolves secrets from THIS PROCESS'S OWN environment variables — i.e.
+# whatever an external mechanism (Kubernetes External Secrets Operator
+# syncing a Secret into envFrom, a Doppler/Infisical "run" wrapper, plain
+# systemd EnvironmentFile, etc.) has already placed into the JVM's
+# environment before OFBiz started. This provider performs no network
+# calls of its own.
+#
+# Name transform (fixed by default — this is the documented convention so
+# any external tool can predict the env var name without reading OFBiz
+# source; see external-secret-injection-architecture.md):
+#   1. Take the OFBiz secret key, e.g. "jdbc-password.mysql-ofbiz"
+#   2. Uppercase it, replace every character that isn't A-Z or 0-9 with "_"
+#      -> "JDBC_PASSWORD_MYSQL_OFBIZ"
+#   3. Prepend envvar.name.prefix
+#      -> "OFBIZ_JDBC_PASSWORD_MYSQL_OFBIZ"
+#
+# NOTE: Only ONE SecretProvider plugin may be active at a time.
+# Deploy only the plugin that matches your environment.
+####
+
+# Prefix prepended to the transformed key when looking up the environment
+# variable. Change only if OFBIZ_ collides with something else in
+# your deployment's environment.
+envvar.name.prefix=OFBIZ_
+
+# Optional per-key overrides for deployments where a specific key needs to resolve to
+# an explicit environment variable name instead of the fixed transform above (e.g. a
+# naming collision with something else already in the process environment). The logical
+# key on the left never changes; the value on the right is used verbatim as the
+# environment variable name (the prefix above is NOT re-applied to it).
+# Format: key.alias.<logicalKey>=<ENV_VAR_NAME>
+# Example:
+# key.alias.jdbc-password.mysql-ofbiz=PROD_OFBIZ_MYSQL_DB_PASSWORD
+# Leave unset (the default) for keys the fixed transform already handles.
+
+# If the expected environment variable is not set, fall back to the value
+# configured for the same key in framework/base/config/passwords.properties.
+# A warning is logged whenever this fallback is used. Values in
+# passwords.properties may be encrypted with ENC(...), see ConfigCryptoUtil
+# and the generateDBPassword/generateEncryptedSecret Gradle tasks.
+# Default: true
+envvar.fallback.enabled=true