Credentials

Read a stored credential in an expression

---

Read a stored credential by name or by regular expression, with a fallback:

fn.fnCredentials('credentialname_or_regex','fallback_credentialname_or_regex')

// Try to use `fnRestBasic` and `fnRestJwtSecure` if possible, this avoids passwords and tokens going over the network.

// output : a credential object with all properties (user, password, host, port)

The exact name is tried first. When no credential has that name, the name is used as a regular expression, and then the fallback is tried.

Limited by role

When one of the user’s roles lists credentials in config.yaml, fn.fnCredentials returns only a credential such a role allows: the role’s patterns are matched against the name of the credential found (by name, regular expression or fallback), and any other is refused. Roles without the list do not limit it, and an admin is never limited.

Credentials from a secret store

A credential that names a secret store gets its user and password from that store at runtime. fn.fnCredentials('myapp') keeps working unchanged.

A secret can also be read without a credential row, wherever a credential name is accepted (including fnRestBasic, fnRestJwtSecure and the header substitutions of fnRestAdvanced):

fn.fnCredentials('secret:vault:secret/ontap')   // secret:<store>:<reference>
fn.fnCredentials('vault:secret/ontap')          // the store named `vault`

The keys of the secret are mapped as described under Key names. A secret with another shape is reshaped with a jq expression as the third argument:

// secret: { "creds": { "u": "admin", "p": "Netapp12" } }
fn.fnCredentials('vault:secret/weird','','.creds | { user: .u, password: .p }')