Credentials objects to be used alongside applications leveraging
the Cortex Data Lake API See Data Lake Quickstart
It also provides the
HubHelper class for quick prototyping SaaS Components to interface with Cortex hub.
Quick overview of available classes
The most basic of them all. It just wraps a static
A credentials object that provides a refreshed
access_token from a known
Best practise to keep secrets secure is to provide them using environmental variables.
But, if needed, you can provide the secrets programatically.
Leverages a Token Redemption service (i.e. API Explorer)
Best practise is to provide the developer token using an environmental variable:
You can pass the developer token programatically if needed
If your application grows to the point it needs to interface with multiple data
lake instances then you'll face the need to store multiple
This is the moment when you can leverage the
class. This class provides methods to cover the full life-cycle of a OAuth2
addWithRefreshToken(): To register a new data lake instance
addWithCode(): To register a new data lake instance using the OAuth2 code (from the code grant flow)
revokeDatalake(): To revoke already issued refresh token
getCredentialsObject(datalakeId): Retrieves a
Credentialsobject bound to the data lake identifier.
HubCredentialProvider is meant to be subclassed. Developer doing so must
implement the following storage methods that will be triggered when needed.
upsertStoreItem(dlid, item): to store
itemas the valuer for data lake instance
deleteStoreItem(dlid): remove the item for the data lake instance
getStoreItem(dlid): retrieve the item for the data lake instance
loadDb(): perform initial database load
Subclass must call
super(opts) with an object with configuration options. The
only two mandatory options are:
clientId: OAuth2 application client_id value
clientSecret: OAuth2 application client_secret value
The library provides a
HubCredentialProvider implementation that stores the
secrets in a local file using AES encryption of sensitive values. You can leverage this class for initial prototyping.
Secrets must me provided as environmental variables:
Now you can register a
refresh_token you've received (i.e. at the end of a
OAuth2 code grant flow)
Or, if you want, you can use the CredentialProvider object to complete the OAuth2 code grant flow for you.
In any case you receive at the end of the process a valid
bound to the provided OAuth2 instance.
Secrets keep stored in a file named
PANCLOUD_CONFIG.json (you can use another
file name using the option
configFile in the static
factory() methods attempts to locate the database file and, if
found, then its content is loaded as initial data. That means that you retrieve
a credentials object for a data lake instance that was registered in another
HubHelper is a class that provides two main features:
- Hooks to help onboard customers that are consuming applications through the
- Generation of the IDP Authentication Request URL
- Completing the OAuth2 code grant flow
- Multi-tenancy: It automates a
HubCredentialProviderleveraging its metadada capability to organize data lakes into tenants.
See code examples in the