SigningHub Core

To use HashiCorp Vault:

SigningHub Admin API supports retrieving sensitive configuration values securely from HashiCorp Vault instead of specifying them directly in the configuration. To configure HashiCorp Vault, add the following section to appsettings.Production.json:

"Vault_Configurations": {
  "HashiCorp": {
    "Login_Url": "",
    "Uami_Url": "",
    "Uami_Name": "",
    "Uami_Client_Id": "",
    "Namespace": ""
  }
}

For the tag with the Login_Url key, specify the URL where the HashiCorp Vault can be accessed for authentication and authorisation.

For the tag with the Uami_Url key, specify the URL endpoint associated with the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault.

For the tag with the Uami_Name key, specify the name of the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault.

For the tag with the Uami_Client_Id key, specify the client ID of the User-Assigned Managed Identity (UAMI) used to authenticate with HashiCorp Vault.

For the tag with the Namespace key, specify the HashiCorp Vault namespace in which the required secrets are stored.

Once HashiCorp Vault is configured, it can be used to securely retrieve sensitive values for the ConnectionString. The ConnectionStrings tag uses the following Vault_Settings configuration::

"ConnectionStrings": {
  "DBConnectionString": "",
  "Vault_Settings": {
    "Vault_Path": "",
    "Secret_Key": "",
    "Secret_Key_Type": ""
  }
}

When Vault_Settings is configured, SigningHub retrieves the corresponding sensitive value from the specified HashiCorp Vault location instead of using the value provided directly in the relevant configuration field.

---

To configure connection strings

The ConnectionStrings section is used to configure the database connection required by SigningHub. These settings can be configured in appsettings.Production.json.

"ConnectionStrings": {
  "DBConnectionString": "data source=192.168.3.45;initial catalog=SH10-Core-QA2;user id=sa;password=p@ssword12;Max Pool Size=3000;Min Pool Size=100;MultipleActiveResultSets=True;Pooling=true;TrustServerCertificate=True",
  "DBProvider": "SQL",
  "Vault_Settings": {
    "Vault_Path": "",
    "Secret_Key": "",
    "Secret_Key_Type": ""
  }
}

The DBConnectionString field specifies the connection string used to connect SigningHub to the database.

The DBProvider field specifies the database provider used by SigningHub.

The Vault_Settings section allows the database connection string to be retrieved securely from HashiCorp Vault instead of specifying it directly in the DBConnectionString field.

For the tag with the Vault_Path key, specify the path to the secret in HashiCorp Vault.

For the tag with the Secret_Key key, specify the key of the secret to retrieve from the specified Vault path.

For the tag with the Secret_Key_Type key, specify the type of secret stored in HashiCorp Vault.

When Vault_Settings is configured, SigningHub retrieves the database connection string from the specified HashiCorp Vault location. Otherwise, the value specified in DBConnectionString is used.

The Vault_Settings subtag is not added by default and must be manually added to the configuration when retrieving the database connection string from HashiCorp Vault.

---

It is recommended to enable the available security-related settings and configure them according to your organisation's security requirements. These settings help strengthen the security of the SigningHub environment and provide additional protection against potential security risks.