Pascal (Lazarus/Delphi)

SSH Tunnel Credentials from OS Secure Storage

Demonstrates the EnableSecrets property, which enables automatic resolution of credentials from the operating system's secure storage. When enabled, password properties and methods may receive a "secret specification string" beginning with !! instead of a literal password.

Background: This is a cleaner alternative to reading a secret yourself and passing it in: with EnableSecrets on, you hand Chilkat a reference like !!my_secret_name and it fetches the actual value from the platform's secure store — Windows Credential Manager, Apple Keychain, and so on. The literal password never appears in your source or configuration, which is exactly the practice recommended throughout these examples.

Chilkat Pascal (Lazarus/Delphi) Downloads

Download Chilkat for Pascal (Lazarus/Delphi)

Pascal (Lazarus/Delphi)

program ChilkatDemo;

// Demonstrates using the Chilkat Pascal wrapper via the C bridge DLL.
// Builds as a console application under Lazarus (FPC) or Delphi.

{$IFDEF FPC}
  {$MODE DELPHI}
{$ENDIF}
{$APPTYPE CONSOLE}

uses
  {$IFDEF UNIX}
  cthreads,
  {$ENDIF}
  SysUtils,
  CkDllLoader,
  Chilkat.SshTunnel;

// ---------------------------------------------------------------------------

procedure RunDemo;
var
  success: Boolean;
  tunnel: TSshTunnel;
  sshPort: Integer;
  password: string;
  listenPort: Integer;
  waitForThreadExit: Boolean;

begin
  success := False;

  //  Demonstrates the SshTunnel.EnableSecrets property, which enables automatic resolution of
  //  credentials from the operating system's secure storage.

  tunnel := TSshTunnel.Create;

  //  When EnableSecrets is True, supported password properties and methods may receive a "secret
  //  specification string" beginning with "!!" instead of a literal password.  Chilkat resolves the
  //  secret from the OS secure store (Windows Credential Manager, Apple Keychain, etc.).
  tunnel.EnableSecrets := True;

  tunnel.DestHostname := 'db.internal.example.com';
  tunnel.DestPort := 5432;

  sshPort := 22;
  success := tunnel.Connect('ssh.example.com',sshPort);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  //  Pass a secret specification instead of a literal password.  Chilkat looks up the named secret
  //  in the OS secure store rather than using this text directly.
  password := '!!my_ssh_password_secret';
  success := tunnel.AuthenticatePw('mySshLogin',password);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;

  listenPort := 1080;
  success := tunnel.BeginAccepting(listenPort);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;
  WriteLn('Authenticated using a secret from OS secure storage.');

  waitForThreadExit := True;
  success := tunnel.CloseTunnel(waitForThreadExit);
  if (success = False) then
    begin
      WriteLn(tunnel.LastErrorText);
      Exit;
    end;


  tunnel.Free;

end;

// ---------------------------------------------------------------------------

begin

  try
    RunDemo;
  except
    on E: Exception do
      WriteLn('Unhandled exception: ', E.ClassName, ': ', E.Message);
  end;

  WriteLn;
  {$IFDEF MSWINDOWS}
  WriteLn('Press Enter to exit...');
  ReadLn;
  {$ENDIF}
end.