Lesson 5 of 6
Security material
9 min
Listen to this lesson
Integration flows need secrets: passwords for SFTP, OAuth client credentials for APIs, private keys for signing, partner certificates for AS2. In Cloud Integration none of these belong in the flow model. They are stored once in the tenant as security material and referenced by alias from adapters. The flow says "use credential LAKESIDE_SFTP"; the tenant decides what that credential is.
Types of security material
| Type | Holds | Contoso example |
|---|---|---|
| User credentials | User name and password, used by adapters with basic authentication | Technical user for the IDoc sender from CMQ |
| OAuth2 client credentials | Token service URL, client ID and secret | Calling a cloud API that issues tokens |
| Secure parameter | A single secret value, such as an API key | An API key a partner issued for its order endpoint |
| Keystore entries | Key pairs and certificates for TLS, signing and encryption | Contoso's client certificate and Great Lakes' AS2 certificate |
| Known hosts | Trusted SSH host keys for SFTP servers | Lakeside's SFTP server host key |
| PGP keyrings | Public and secret keys for PGP encryption of payloads | Encrypting payment files for the bank |
Once deployed, a stored password or secret can no longer be read back in the user interface; you can only replace it. That is the point. It also means the team needs a controlled process for who sets production secrets, where the source value is held, and how it is rotated, because "just look it up in the tenant" is not an option.
Certificates expire on a schedule
Certificate expiry is the most predictable integration outage there is, and it still causes many of them. Keystore entries show their validity dates. Build a calendar of every certificate the tenant relies on, including partner certificates you do not control, and renew well ahead. For AS2 and TLS with partners, renewal is a coordinated change on both sides, with a test.
- 90 days beforeExpiry flaggedCertificate calendar shows Great Lakes' AS2 certificate expiring.
- 60 days beforePartner contactedNew certificate requested and change window agreed.
- 30 days beforeTest tenantNew certificate added; connectivity test and one test order pass.
- Change windowProductionCertificate switched; first production order checked end to end.
- AfterOld entry removedCalendar updated with the new expiry date.
Separation between tenants
- Use the same alias in every tenant, with different values: the test tenant's LAKESIDE_SFTP points to the test user, the production one to the production user.
- Never copy production secrets into the test tenant to make a test pass.
- Restrict who can deploy security material in production, and log every change.
- Use the connectivity tests in Monitor to check a host, certificate or SSH key before the first real message.
- For on-premise targets, remember Cloud Connector has its own access control: the endpoint must be published there as well.
What would you do?
The Lakeside flow's Wave 1 production switch is on Saturday. On Wednesday Sam notices that the production tenant's credential for the IDoc sender from CMP was never deployed; the flow only references the alias. What is the right next step?
- Credentials, keys and certificates live in the tenant as security material, referenced by alias.
- Deployed secrets cannot be read back; manage source values and rotation through a controlled process.
- Keep a certificate expiry calendar, including partner certificates.
- Same alias, different values per tenant; prove connectivity before interface testing.
Check your understanding · not graded
Lesson check
1. How does an adapter use a password stored as security material?
2. Which security material type holds an SFTP server's trusted host key?
3. Why should the test and production tenants use the same alias with different values?
4. What is the most reliable way to avoid a certificate-expiry outage?