Skip to main content

On Premises Engine Secret Storage Options

There are multiple options for storing your secrets for the SigParser On Premise Engine ranked from easiest to most complicated.

appsettings.json (Easiest)

This option is fine for more organizations as long as the machine is secured. The appsettings.json template comes setup for this already.

secrets.json

You can keep your secrets.json on a path that is accessible to the application. You'll need to create an environment variable called ON_PREM_SECRETS_FILE_LOCATION with the full path to the secrets.json file.

For example:

C:/secure/secrets.json

Example File:

{
   "Office365": {
      "ClientSecret": "??????????????????????????????"
   }
}

For Exchange

{
   "Exchange": {
      "Password": "??????????????????????????????"
   }
}

Environment Variable

You can put the ClientSecret in an environment variable like so. For example, for the Office365 client secret or Exchange Password you would name them like so:

Office365__ClientSecret
Exchange__Password

Windows Credential Manager

Create a stored credential in Windows Credential Manager

# Ensure the module is installed
if (-not (Get-Module -ListAvailable -Name CredentialManager)) {
    Install-Module -Name CredentialManager -Scope CurrentUser -Force
}

Import-Module CredentialManager

# Define your values
$targetName = "ClientSecret"
$username = "dummy"  # Required, but not used in this case
$password = Read-Host -AsPlainText "Enter the ClientSecret value"

# Save the credential
New-StoredCredential -Target $targetName `
                     -Username $username `
                     -Password $password `
                     -Persist LocalMachine `
                     -Type Generic

Write-Host "Credential '$targetName' stored successfully."

Create a Powershell script .ps1 file on the server that will be run by the task schedule to invoke the EmailFetcher with the secret value in the command line argument. 

# Ensure CredentialManager module is installed
if (-not (Get-Module -ListAvailable -Name CredentialManager)) {
    try {
        Write-Host "Installing CredentialManager module..."
        Install-Module -Name CredentialManager -Scope CurrentUser -Force -ErrorAction Stop
    } catch {
        Write-Error "Failed to install CredentialManager module: $_"
        exit 1
    }
}

Import-Module CredentialManager -ErrorAction Stop

# Fetch the credential from Windows Credential Manager
try {
    $credential = Get-StoredCredential -Target "ClientSecret"

    if ($null -eq $credential) {
        Write-Error "Credential 'ClientSecret' not found in Windows Credential Manager."
        exit 1
    }

    $clientSecret = $credential.GetNetworkCredential().Password

    # Run the executable with the secret
    $processInfo = New-Object System.Diagnostics.ProcessStartInfo
    $processInfo.FileName = "EmailFetcher.exe"
    $processInfo.Arguments = "--Office365:ClientSecret `"$clientSecret`""
    # May need to update this folder path
    $processInfo.WorkingDirectory = "c:\sigparser\emailfetcher\"
    $processInfo.RedirectStandardOutput = $true
    $processInfo.RedirectStandardError = $true
    $processInfo.UseShellExecute = $false
    $processInfo.CreateNoWindow = $true

    $process = New-Object System.Diagnostics.Process
    $process.StartInfo = $processInfo

    $process.Start() | Out-Null
    $stdout = $process.StandardOutput.ReadToEnd()
    $stderr = $process.StandardError.ReadToEnd()
    $process.WaitForExit()

    Write-Output $stdout
    if ($stderr) {
        Write-Error $stderr
    }

    exit $process.ExitCode
}
catch {
    Write-Error "An error occurred: $_"
    exit 1
}

Azure Key Vault with Powershell

  1. Create an Azure Key Vault

  2. Add a key to the Key Vault with the Client Secret

  3. Make sure the VM in Azure has permission to fetch the secrets from Azure Key Vault.

Install Azure Powershell module on the VM

Install-Module -Name Az.Accounts, Az.KeyVault -Scope CurrentUser -Repository PSGallery -Force

Comment out Secrets from appsettings.json

"ApiExporter": {
    //"ApiKey": "",
    "ApiUrl": "https://ipaas.sigparser.com"
  },
  "Office365": {
    //"ClientSecret": ""
  }

If you don't do this it will try to use the appsettings.json values over the environment variables.

Create a run.ps1 file

# --- Config: set these to your values ---
  $VaultName       = '<your-keyvault-name>'
  $ApiKeySecret    = '<sigparser-api-key-secret-name>'
  $ClientSecretKey = '<office365-client-secret-name>'

  # --- Authenticate with the VM's managed identity (no interactive login) ---
  Connect-AzAccount -Identity | Out-Null
  # For a user-assigned identity, add: -AccountId '<identity-client-id>'

  # --- Pull secrets from Key Vault ---
  $env:ApiExporter__ApiKey     = Get-AzKeyVaultSecret -VaultName $VaultName -Name $ApiKeySecret    -AsPlainText
  $env:Office365__ClientSecret = Get-AzKeyVaultSecret -VaultName $VaultName -Name $ClientSecretKey -AsPlainText

  # --- Verify the API key before launching (masked: shows only last 4 chars) ---
  $key = $env:ApiExporter__ApiKey
  Write-Host "ApiExporter:ApiKey = ...$($key.Substring([Math]::Max(0, $key.Length - 4)))"

  # --- Start the engine ---
  try { .\EmailFetcher.exe }
  finally {
      # Clear secrets from this session's environment
      Remove-Item Env:ApiExporter__ApiKey, Env:Office365__ClientSecret -ErrorAction SilentlyContinue
  }

Did this answer your question?