HashiCorp Vault Properties Provider 1.0 Reference

HashiCorp Vault Properties Provider enables Mule applications to retrieve configuration properties from HashiCorp Vault.

Select exactly one authentication type: Token, AppRole, or LDAP.

Configurations

Config

Default configuration.

Parameters

Name Type Description Default Value Required

Name	Type	Description	Default Value	Required
Name	String	The name for this configuration. Connectors reference the configuration with this name.		x
Vault Address	String	Absolute HTTP or HTTPS URL of the Vault server. Include only the origin, with no path.		x
Authentication	One of: Token Authentication AppRole Authentication LDAP Authentication	Exactly one Vault authentication type: Token, AppRole, or LDAP.		x
Secrets Mount	String	Vault secrets engine mount name for key-value version 2. The value cannot be blank if specified.	secret
Vault Namespace	String	Optional Vault Enterprise or HCP namespace. Mule sends it in the `X-Vault-Namespace` header on login and secret reads.
Connection Timeout	Number	TCP connect timeout to Vault. The Connection Timeout Unit field qualifies this value.	10
Connection Timeout Unit	Enumeration, one of: NANOSECONDS MICROSECONDS MILLISECONDS SECONDS MINUTES HOURS DAYS	Time unit for the Connection Timeout field.	SECONDS
Response Timeout	Number	HTTP read timeout for Vault responses. The Response Timeout Unit field qualifies this value.	30
Response Timeout Unit	Enumeration, one of: NANOSECONDS MICROSECONDS MILLISECONDS SECONDS MINUTES HOURS DAYS	Time unit for the Response Timeout field.	SECONDS
Proxy	Proxy	Optional HTTP proxy for Vault requests. Host and port are required.
TLS Context	TLS	Optional nested Mule `tls:context`, placed as the first child of the configuration, for a custom truststore or mutual TLS to Vault.

Name

String

The name for this configuration. Connectors reference the configuration with this name.

Vault Address

String

Absolute HTTP or HTTPS URL of the Vault server. Include only the origin, with no path.

Authentication

One of:

Token Authentication
AppRole Authentication
LDAP Authentication

Exactly one Vault authentication type: Token, AppRole, or LDAP.

Secrets Mount

String

Vault secrets engine mount name for key-value version 2. The value cannot be blank if specified.

secret

Vault Namespace

String

Optional Vault Enterprise or HCP namespace. Mule sends it in the X-Vault-Namespace header on login and secret reads.

Connection Timeout

Number

TCP connect timeout to Vault. The Connection Timeout Unit field qualifies this value.

Connection Timeout Unit

Enumeration, one of:

NANOSECONDS
MICROSECONDS
MILLISECONDS
SECONDS
MINUTES
HOURS
DAYS

Time unit for the Connection Timeout field.

SECONDS

Response Timeout

Number

HTTP read timeout for Vault responses. The Response Timeout Unit field qualifies this value.

Response Timeout Unit

Enumeration, one of:

NANOSECONDS
MICROSECONDS
MILLISECONDS
SECONDS
MINUTES
HOURS
DAYS

Time unit for the Response Timeout field.

SECONDS

Proxy

Optional HTTP proxy for Vault requests. Host and port are required.

TLS Context

TLS

Optional nested Mule tls:context, placed as the first child of the configuration, for a custom truststore or mutual TLS to Vault.

Types

Proxy

Configures a proxy for outbound connections.

Field Type Description Default Value Required

Field	Type	Description	Required
Host	String	Hostname or IP address of the proxy server.	x
Port	Number	Port of the proxy server.	x
Username	String	Username to authenticate against the proxy server.
Password	String	Password to authenticate against the proxy server.
Non Proxy Hosts	String	Comma-separated list of hosts (for example, `localhost,127.*`) that bypass the proxy.

Host

String

Hostname or IP address of the proxy server.

Port

Number

Port of the proxy server.

Username

String

Username to authenticate against the proxy server.

Password

String

Password to authenticate against the proxy server.

Non Proxy Hosts

String

Comma-separated list of hosts (for example, localhost,127.*) that bypass the proxy.

Token Authentication

Token authentication for the HashiCorp Vault properties provider.

Field	Type	Description	Default Value	Required
Token	String	Token used to authenticate to Vault.		x

Field

Type

Description

Default Value

Required

Token

String

Token used to authenticate to Vault.

AppRole Authentication

AppRole authentication for the HashiCorp Vault properties provider.

Field Type Description Default Value Required

Field	Type	Description	Default Value	Required
Role ID	String	AppRole `role_id`.		x
Secret ID	String	AppRole `secret_id`.		x
Auth Mount	String	Vault authentication mount path for AppRole login.	approle

Role ID

String

AppRole role_id.

Secret ID

String

AppRole secret_id.

Auth Mount

String

Vault authentication mount path for AppRole login.

approle

LDAP Authentication

LDAP authentication for the HashiCorp Vault properties provider.

Field	Type	Description	Default Value	Required
LDAP Username	String	LDAP username.		x
LDAP Password	String	LDAP password.		x
LDAP Auth Mount	String	Vault authentication mount path for LDAP login.	ldap

Field

Type

Description

Default Value

Required

LDAP Username

String

LDAP username.

LDAP Password

String

LDAP password.

LDAP Auth Mount

String

Vault authentication mount path for LDAP login.

ldap

TLS

Configures TLS to provide secure communications for the Mule app.

Field	Type	Description
Enabled Protocols	String	Comma-separated list of protocols enabled for this context.
Enabled Cipher Suites	String	Comma-separated list of cipher suites enabled for this context.
Trust Store	Truststore	Configures the TLS truststore.
Key Store	Keystore	Configures the TLS keystore.
Revocation Check	Standard Revocation Check Custom OCSP Responder CRL File	Configures a revocation checking mechanism.

Field

Type

Description

Default Value

Required

Enabled Protocols

String

Comma-separated list of protocols enabled for this context.

Enabled Cipher Suites

String

Comma-separated list of cipher suites enabled for this context.

Trust Store

Truststore

Configures the TLS truststore.

Key Store

Keystore

Configures the TLS keystore.

Revocation Check

Standard Revocation Check
Custom OCSP Responder
CRL File

Configures a revocation checking mechanism.

Truststore

Configures the truststore for TLS.

Field Type Description Default Value Required

Field	Type	Description
Path	String	Path to the truststore. Mule resolves the path relative to the current classpath and file system.
Password	String	Password used to protect the truststore.
Type	String	Type of store.
Algorithm	String	Encryption algorithm that the truststore uses.
Insecure	Boolean	If `true`, Mule stops performing certificate validations. Setting this to `true` can make connections vulnerable to attacks.

Path

String

Path to the truststore. Mule resolves the path relative to the current classpath and file system.

Password

String

Password used to protect the truststore.

Type

String

Type of store.

Algorithm

String

Encryption algorithm that the truststore uses.

Insecure

Boolean

If true, Mule stops performing certificate validations. Setting this to true can make connections vulnerable to attacks.

Keystore

Configures the keystore for the TLS protocol. The keystore you generate contains a private key and a public certificate.

Field	Type	Description
Path	String	Path to the keystore. Mule resolves the path relative to the current classpath and file system.
Type	String	Type of store.
Alias	String	Alias of the key to use when the keystore contains multiple private keys. By default, Mule uses the first key in the file.
Key Password	String	Password used to protect the private key.
Password	String	Password used to protect the keystore.
Algorithm	String	Encryption algorithm that the keystore uses.

Field

Type

Description

Default Value

Required

Path

String

Path to the keystore. Mule resolves the path relative to the current classpath and file system.

Type

String

Type of store.

Alias

String

Alias of the key to use when the keystore contains multiple private keys. By default, Mule uses the first key in the file.

Key Password

String

Password used to protect the private key.

Password

String

Password used to protect the keystore.

Algorithm

String

Encryption algorithm that the keystore uses.

Standard Revocation Check

Configures standard revocation checks for TLS certificates.

Field Type Description Default Value Required

Field	Type	Description
Only End Entities	Boolean	Which elements to verify in the certificate chain: `true` Verify only the last element in the certificate chain. `false` Verify all elements in the certificate chain.
Prefer Crls	Boolean	How to check certificate validity: `true` Check the Certificate Revocation List (CRL) for certificate validity. `false` Use the Online Certificate Status Protocol (OCSP) to check certificate validity.
No Fallback	Boolean	Whether to use the secondary method to check certificate validity: `true` Use the method that was not specified in the Prefer Crls field (the secondary method) to check certificate validity. `false` Do not use the secondary method to check certificate validity.
Soft Fail	Boolean	What to do if the revocation server cannot be reached or is busy: `true` Avoid verification failure. `false` Allow the verification to fail.

Only End Entities

Boolean

Which elements to verify in the certificate chain:

true

Verify only the last element in the certificate chain.

false

Verify all elements in the certificate chain.

Prefer Crls

Boolean

How to check certificate validity:

true

Check the Certificate Revocation List (CRL) for certificate validity.

false

Use the Online Certificate Status Protocol (OCSP) to check certificate validity.

No Fallback

Boolean

Whether to use the secondary method to check certificate validity:

true

Use the method that was not specified in the Prefer Crls field (the secondary method) to check certificate validity.

false

Do not use the secondary method to check certificate validity.

Soft Fail

Boolean

What to do if the revocation server cannot be reached or is busy:

true

Avoid verification failure.

false

Allow the verification to fail.

Custom OCSP Responder

Configures a custom OCSP responder for certificate revocation checks.

Field	Type	Description	Default Value	Required
URL	String	URL of the OCSP responder.
Cert Alias	String	Alias of the signing certificate for the OCSP response. If specified, the alias must be in the truststore.

Field

Type

Description

Default Value

Required

URL

String

URL of the OCSP responder.

Cert Alias

String

Alias of the signing certificate for the OCSP response. If specified, the alias must be in the truststore.

CRL File

Specifies the location of the certificate revocation list (CRL) file.

Field	Type	Description	Default Value	Required
Path	String	Path to the CRL file.

Field

Type

Description

Default Value

Required

Path

String

Path to the CRL file.