How to securely store secret?

Help Studio
1

Hello

I would like to securely store a secret and use it as a string but it is giving me an error
why

2

@adext01

you can convert you securestring to string

or also generally instead of storing full url , we store only the sensitive part in creds and append it

New.Net.NetworkCredential("",Yoursecurestringvariable).Password - will convert securestring to string

coming to the rule you can always exclude if you dont need it..its good to have

image
image992×126 16.6 KB

cheers

3

@adext01

The issue was HTTP activity expecting string variable but when you use get credential asset then password will be stored in Secure String type. So before using it in HTTP activity you need convert that secure string to String.

Before directly passing the get credential output password variable in http activity.
Take assign activity after the Get credential activity or before of HTTP activity and create any variable let say strEndPoint and pass that in To section of Assign and in Value section pass the below expression,

new System.Net.NetworkCredential(String.Empty, yoursecurestringvariable).Password

And then pass strEndPoint in your http activity.

Hope this will helps you.

Happy automation

4

I believe that warning is about scoping of your SecureString variable. It should only be scope to the activity in which you need it. For example, if your HTTP activity is in a Sequence, the SecureString variable should be scoped to that Sequence (and your Get Credential activity should also be in that same Sequence).

This way the variable is destroyed as soon as the Sequence ends.

5

Convert the SecureString to a string using this C#. It is dirty but quick.

string plainText = new NetworkCredential(string.Empty, secureString).Password;

6

Hi @adext01,

You can store your secret in an Asset of type Secret and retrieve it in your workflow using the Get Secret activity. Create an output variable from the Get Secret activity (using Ctrl+K).

You can use the following expression in the required field, assign, or expression to use the secret as a string:

New System.Net.NetworkCredential(String.Empty, secureStr).Password

where secureStr is the output variable from the Get Secret activity.

Thanks

7

@adext01,

which activity accepts a secret as plain text? That’s not what a password is about. I would highly suggest using them as SecretString’s :slight_smile:

However, if you really need to do it “quick and dirty”, you can use the following:

System.Net.NetworkCredential("", YourSecureStringPassword).Password

Cheers,
Alex