DataFlex

SSH Tunnel Credentials from OS Secure Storage

Demonstrates the EnableSecrets property, which enables automatic resolution of credentials from the operating system's secure storage. When enabled, password properties and methods may receive a "secret specification string" beginning with !! instead of a literal password.

Background: This is a cleaner alternative to reading a secret yourself and passing it in: with EnableSecrets on, you hand Chilkat a reference like !!my_secret_name and it fetches the actual value from the platform's secure store — Windows Credential Manager, Apple Keychain, and so on. The literal password never appears in your source or configuration, which is exactly the practice recommended throughout these examples.

Chilkat DataFlex Downloads

Download Chilkat for DataFlex

DataFlex

Use ChilkatAx-win32.pkg

Procedure Test
    Boolean iSuccess
    Handle hoTunnel
    Integer iSshPort
    String sPassword
    Integer iListenPort
    Boolean iWaitForThreadExit
    String sTemp1

    Move False To iSuccess

    //  Demonstrates the SshTunnel.EnableSecrets property, which enables automatic resolution of
    //  credentials from the operating system's secure storage.

    Get Create (RefClass(cComChilkatSshTunnel)) To hoTunnel
    If (Not(IsComObjectCreated(hoTunnel))) Begin
        Send CreateComObject of hoTunnel
    End

    //  When EnableSecrets is True, supported password properties and methods may receive a "secret
    //  specification string" beginning with "!!" instead of a literal password.  Chilkat resolves the
    //  secret from the OS secure store (Windows Credential Manager, Apple Keychain, etc.).
    Set ComEnableSecrets Of hoTunnel To True

    Set ComDestHostname Of hoTunnel To "db.internal.example.com"
    Set ComDestPort Of hoTunnel To 5432

    Move 22 To iSshPort
    Get ComConnect Of hoTunnel "ssh.example.com" iSshPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    //  Pass a secret specification instead of a literal password.  Chilkat looks up the named secret
    //  in the OS secure store rather than using this text directly.
    Move "!!my_ssh_password_secret" To sPassword
    Get ComAuthenticatePw Of hoTunnel "mySshLogin" sPassword To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Move 1080 To iListenPort
    Get ComBeginAccepting Of hoTunnel iListenPort To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End

    Showln "Authenticated using a secret from OS secure storage."

    Move True To iWaitForThreadExit
    Get ComCloseTunnel Of hoTunnel iWaitForThreadExit To iSuccess
    If (iSuccess = False) Begin
        Get ComLastErrorText Of hoTunnel To sTemp1
        Showln sTemp1
        Procedure_Return
    End



End_Procedure