Storing Secrets for Scripts

Secrets provide a method to store passwords and other confidential data in QPR ProcessAnalyzer, and use them without being able to see the stored secret values. For example in scripts, SAP, Salesforce and ODBC passwords can be stored as secrets, which can be referred by their names in the script commands.

There are project-specific and global secrets. To use a secret, the user needs to have GenericRead permission to the project (or global GenericRead to use global secrets). To define a secret, the ManageProject permission to the project is needed (or global ManageProject to define global secrets). If both a global and a project-specific secret with the same name and type are set, the project-specific secret will be used in that project, and thus the global secret is unavailable for that project.

Each secret has a type which defines in which command the secret can be used. The purpose of the type is to improve security, so that the secret can only be used in the intended command.

Setting secrets

Secrets can be set by calling the SetSecret function for the project, or the corresponding generic context SetSecret function.

Example: Set a project secret (for project id 1):

ProjectById(1).SetSecret("sap", "SapAdminPassword", "I l0ve 5AP!");

Example: Set a global secret:

SetSecret("sap", "SapReaderPassword", "I l0ve 5AP!");

Listing secrets

To list all secrets in the project, there is a property Secrets for projects. For the global secrets, there is the corresponding global Secrets property. Note that the secret value cannot be retrieved even by system administrators.

Example: Show project secrets (for project id 1):

ToJson(ProjectById(1).Secrets);

Example: Show global secrets:

ToJson(Secrets);

Using secrets

Secrets can be used in the following commands:

• SQL scripting commands: ImportOdbcQuery, ImportSalesforceQuery and ImportSapQuery.
• ODBC datasources of model.
• ImportODBCSecure function (expression language)
• CreateSnowflakeConnection function (expression language)

Note: Currently ImportSqlQuery and ImportOleDbQuery don't yet support the secrets.