Oracle^® Business Intelligence Enterprise Edition Deployment Guide > Oracle BI Presentation Services Credential Store > Credential Store Storage Types >

Custom Store

The BI Presentation Services Credential Store supports the storage of keys and secrets in custom storage systems. Administrators must write a program or shell script that extracts the credential data from the custom store and writes them to standard output in a well-defined text based interchange format. This custom loader must be specified in the commandLine attribute of the CredentialStorage element in the instanceconfig.xml file. At initialization of the BI Presentation Services Credential Store, the custom executable or script is launched and the Credential Store service creates an anonymous pipe to access the standard output of the custom program, thus ensuring that sensitive data is not written to any temporary file on disk.

The command line that should be executed to run the custom credential store loader should only consist of the path to the executable or script and any necessary arguments. Any redirection of standard output will fail as BI Presentation Services needs standard output to read the results from. Redirection of standard input is also not supported.

The custom executable or script must extract credentials from the store of choice and write them to standard output in a well-defined text based format. Industry standard PEM (unencrypted) format must be used for X.509 keys and certificates. A proprietary format defined by BI Presentation Services must be used for username/password based credentials. The format is described below.

Stream Structure

The general format of the stream is plain text. A rough grammar is below.

NOTE:  Certificates and private keys having the same alias will get grouped into one credential.

entity (EOL entity)*
entity      = x509entity | upwdentity
x509entity   = x509type ":" alias EOL x509body
upwdentity   = "Username Password" ":" alias EOL upwdbody
x509type   = "Key Certificate(PEM)" | "Private Key(PEM)" | "CA Certificate(PEM)"
alias      = Sequence of printable ASCII characters, excluding whitespace.
EOL      = "\r\n" | "\n"
x509body   = PEM encoded contents
upwdbody   = username EOL password
username   = Sequence of printable ASCII characters excluding EOL
password   = Sequence of printable ASCII characters excluding EOL

Stream Example

The following example contains entries for:

• An X.509 credential (key and certificate) with alias "obiserver"
• An X.509 CA certificate with alias "obica"
• A username password credential for "testuser"

  Key Certificate(PEM):obiserver
  -----BEGIN CERTIFICATE-----
  MIIEOTCCA6KgAwIBAgIBCTANBgkqhkiG9w0BAQQFADBXMQ8wDQYDVQQDEwZTQVcg
  Q0ExCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlNaW5uZXNvdGExDzANBgNVBAoTBlNp
  ZWJlbDESMBAGA1UECxMJQW5hbHl0aWNzMB4XDTA2MDYwMjE1NTYwNFoXDTA3MDYw
  MjE1NTYwNFowYTELMAkGA1UEBhMCVVMxCzAJBgNVBAgTAk1OMRQwEgYDVQQHEwtC
  bG9vbWluZ3RvbjEPMA0GA1UEChMGT3JhY2xlMQswCQYDVQQLEwJCSTERMA8GA1UE
  AxMISmF2YUhvc3QwggG3MIIBLAYHKoZIzjgEATCCAR8CgYEA/X9TgR11EilS30qc
  Luzk5/YRt1I870QAwx4/gLZRJmlFXUAiUftZPY1Y+r/F9bow9subVWzXgTuAHTRv
  8mZgt2uZUKWkn5/oBHsQIsJPu6nX/rfGG/g7V+fGqKYVDwT7g/bTxR7DAjVUE1oW
  kTL2dfOuK2HXKu/yIgMZndFIAccCFQCXYFCPFSMLzLKSuYKi64QL8Fgc9QKBgQD3
  4aCF1ps93su8q1w2uFe5eZSvu/o66oL5V0wLPQeCZ1FZV4661FlP5nEHEIGAtEkW
  cSPoTCgWE7fPCTKMyKbhPBZ6i1R8jSjgo64eK7OmdZFuo38L+iE1YvH7YnoBJDvM
  pPG+qFGQiaiD3+Fa5Z8GkotmXoB7VSVkAUw7/s9JKgOBhAACgYAYbpdoPpMmgPeF
  yw+TySZWxJFnOGEF4Qdu36Iogfixv2keMo+/c18hXnT2gs2wM4fDfegKzQMQ164Z
  lBkiUtNoI1wRuwNpAm/adgr6ndewJl/mCWzHLtbdvu0v8HOjrRf8xvYBmLokDREI
  wsnmBCmJ516eNE/dpOHFjm7a5OCidqOB8TCB7jAMBgNVHRMBAf8EAjAAMB0GA1Ud
  DgQWBBRp7oqPTp08t7AXJnLn2gK3JT65pjB/BgNVHSMEeDB2gBRMIr9mpa2SZddi
  dva/y449nmhVHaFbpFkwVzEPMA0GA1UEAxMGU0FXIENBMQswCQYDVQQGEwJVUzES
  MBAGA1UECBMJTWlubmVzb3RhMQ8wDQYDVQQKEwZTaWViZWwxEjAQBgNVBAsTCUFu
  YWx5dGljc4IBATALBgNVHQ8EBAMCBeAwEQYJYIZIAYb4QgEBBAQDAgZAMB4GCWCG
  SAGG+EIBDQQRFg94Y2EgY2VydGlmaWNhdGUwDQYJKoZIhvcNAQEEBQADgYEAV1eJ
  DfkWe2sXnU0ozMWXnBXPE6wpXsjDwEqdwc8ELK7GjUZmpbggZtkzGo9lR53SZ10S
  41FoSqoBfYR7CijnMCpvEUhAq1/EpMHd3dqqm9o=
  -----END CERTIFICATE-----
  Private Key(PEM):obiserver
  -----BEGIN PRIVATE KEY-----
  MIIBSwIBADCCASwGByqGSM44BAEwggEfAoGBAP1/U4EddRIpUt9KnC7s5Of2EbdS
  PO9EAMMeP4C2USZpRV1AIlH7WT2NWPq/xfW6MPbLm1Vs14E7gB00b/JmYLdrmVCl
  pJ+f6AR7ECLCT7up1/63xhv4O1fnxqimFQ8E+4P208UewwI1VBNaFpEy9nXzrith
  1yrv8iIDGZ3RSAHHAhUAl2BQjxUjC8yykrmCouuEC/BYHPUCgYEA9+GghdabPd7L
  vKtcNrhXuXmUr7v6OuqC+VdMCz0HgmdRWVeOutRZT+ZxBxCBgLRJFnEj6EwoFhO3
  zwkyjMim4TwWeotUfI0o4KOuHiuzpnWRbqN/C/ohNWLx+2J6ASQ7zKTxvqhRkImo
  g9/hWuWfBpKLZl6Ae1UlZAFMO/7PSSoEFgIUHiP33wBqFCtvYwfEcPskjJY4kIc=
  -----END PRIVATE KEY-----
  CA Certificate(PEM):obica
  -----BEGIN CERTIFICATE-----
  MIIDGTCCAoKgAwIBAgIBATANBgkqhkiG9w0BAQUFADBXMQ8wDQYDVQQDEwZTQVcg
  Q0ExCzAJBgNVBAYTAlVTMRIwEAYDVQQIEwlNaW5uZXNvdGExDzANBgNVBAoTBlNp
  ZWJlbDESMBAGA1UECxMJQW5hbHl0aWNzMB4XDTA2MDEzMDIzMDAzMFoXDTE2MDEy
  ODIzMDAzMFowVzEPMA0GA1UEAxMGU0FXIENBMQswCQYDVQQGEwJVUzESMBAGA1UE
  CBMJTWlubmVzb3RhMQ8wDQYDVQQKEwZTaWViZWwxEjAQBgNVBAsTCUFuYWx5dGlj
  czCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAn5uiQ/YRu76ABfnKyHvIDOUt
  dbZpwGiqA7VVRQcr/RJN5Yi1Nn5W2jF/n3C3MFnHX93u1V4+kevwoN631FaARwcg
  PjaTtqzCbQRsqY+QBCRdB1I/+sifsgIqnOOO/tZCl9iVVU0IhZArDQeTX+9/6/bc
  DgQWBBRMIr9mpa2SZddidva/y449nmhVHTB/BgNVHSMEeDB2gBRMIr9mpa2SZddi
  dva/y449nmhVHaFbpFkwVzEPMA0GA1UEAxMGU0FXIENBMQswCQYDVQQGEwJVUzES
  MBAGA1UECBMJTWlubmVzb3RhMQ8wDQYDVQQKEwZTaWViZWwxEjAQBgNVBAsTCUFu
  YWx5dGljc4IBATALBgNVHQ8EBAMCAYYwEQYJYIZIAYb4QgEBBAQDAgAHMB4GCWCG
  SAGG+EIBDQQRFg94Y2EgY2VydGlmaWNhdGUwDQYJKoZIhvcNAQEFBQADgYEAT5rs
  vNppAZCxjKmZxpyGlPZwCXHtV8y0RIAH42gs1uE4HkhMElkiirKbYdvQq1o8t8P6
  DFjGCdXBABgLUx69Uwcv/1K8LHtnLCSYoiNf/ka8Y8qaIv74wnGAAysfLm8gISP7
  YxoqnJKqVbCVqtyKR29RTA+YAwNPpbvw083qpRw=
  -----END CERTIFICATE-----
  Username Password:testuser
  testuser
  testpassword