Default Credential Manager is our implementation of the Imperative Credential Manager. This manager invokes methods created by the keytar utility (https://www.npmjs.com/package/keytar) to access the secure credential vault on the user's machine.

### Keychains Used by Keytar

OS | Vault
--- | ---
Windows | Credential Vault
macOS | Keychain
Linux | Secret Sevice API/libsecret

### Keytar must be installed by the app using imperative (like zowe-cli).

On Linux, Keytar will not work out of the box without some additional configuration to install libsecret. Keytar provides the following documentation for Linux users to install libsecret:

Depending on your distribution, you will need to run the following command:

- Debian/Ubuntu: `sudo apt-get install libsecret-1-dev`
- Red Hat-based: `sudo yum install libsecret-devel`
- Arch Linux: `sudo pacman -S libsecret`

### Hierarchy

- AbstractCredentialManager
  - DefaultCredentialManager

## Index

### Constructors

- constructor

### Properties

- WIN32_CRED_MAX_STRING_LENGTH
- allServices
- credentialManagerOptions
- keytar
- loadError
- persistValueWin32
- service
- SVC_NAME

### Accessors

- defaultService
- name
- possibleSolutions

### Methods

- checkForKeytar
- delete
- deleteCredentials
- deleteCredentialsHelper
- getCredentialsHelper
- getMissingEntryMessage
- initialize
- load
- loadCredentials
- save
- saveCredentials
- secureErrorDetails
- setCredentialsHelper

## Constructors

### constructor

- new DefaultCredentialManager(service: string, displayName?: string, options?: IDefaultCredentialManagerOptions): DefaultCredentialManager

- Overrides AbstractCredentialManager.constructor

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:85

  Pass-through to the superclass constructor.

  #### Parameters

  - ##### service: string

    The service string to send to the superclass constructor.

  - ##### Default value displayName: string = "default credential manager"

    The display name for this credential manager to send to the superclass constructor

  - ##### Optional options: IDefaultCredentialManagerOptions

    Optional configuration options for the credential manager

  #### Returns DefaultCredentialManager

## Properties

### Private Readonly WIN32_CRED_MAX_STRING_LENGTH

WIN32_CRED_MAX_STRING_LENGTH: 2560 = 2560

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:85

Maximum credential length allowed by Windows 7 and newer.

We don't support older versions of Windows where the limit is 512 bytes.

### Private allServices

allServices: string[]

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:72

Combined list of services that the plugin will go through

### Protected Optional credentialManagerOptions

credentialManagerOptions: ICredentialManagerOptions

Inherited from AbstractCredentialManager.credentialManagerOptions

- Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:70

Options provided to the credential manager for configuration. Credential managers can use these options to customize their behavior.

### Private keytar

keytar: typeof keytar

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:56

Reference to the lazily loaded keytar module.

### Private loadError

loadError: ImperativeError

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:67

Errors that occurred while loading keytar will be stored in here.

Every method of this class should call the checkForKeytar method before proceeding. It is this method that will check for keytar and throw this error if it was detected that keytar wasn't loaded.

### Private Readonly persistValueWin32

persistValueWin32: PersistenceValue = PersistenceValue.Enterprise

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:78

Defines the persistence level for credentials Windows environments. The default persistence value is CRED_PERSIST_ENTERPRISE (0x3) for backwards compatibility w/ node-keytar.

### Protected Readonly service

service: string

Inherited from AbstractCredentialManager.service

- Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:82

The service that the Credential Manager is running under. Imperative will set this to the cliName

### Static Readonly SVC_NAME

SVC_NAME: "Zowe" = "Zowe"

- Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:51

The service name for our built-in credential manager.

## Accessors

### Private defaultService

- get defaultService(): string

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:253

  The default service name for storing credentials.

  #### Returns string

### name

- get name(): string

- Inherited from AbstractCredentialManager.name

  - Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:89

  #### Returns string

  - the display name of this manager. Use in logging/messaging.

### Protected possibleSolutions

- get possibleSolutions(): string[]

- Overrides AbstractCredentialManager.possibleSolutions

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:171

  #### Returns string[]

## Methods

### Private checkForKeytar

- checkForKeytar(): void

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:273

  This function is called before the {@link deletePassword}, {@link getPassword}, and {@link setPassword} functions. It will check if keytar is not null and will throw an error if it is.

  The error thrown will be the contents of loadError or a new ImperativeError. The former error will be the most common one as we expect failures during the load since keytar is optional. The latter error will indicate that some unknown condition has happened so we will create a new ImperativeError with the report suppressed. The report is suppressed because it may be possible that a detailed report could capture a username and password, which would probably be a bad thing.

  throws

    ImperativeError when keytar is null or undefined.

  #### Returns void

### delete

- delete(account: string): Promise<void>

- Inherited from AbstractCredentialManager.delete

  - Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:100

  Delete credentials for an account managed by the credential manager.

  #### Parameters

  - ##### account: string

    The account (or profile identifier) associated with credentials

  #### Returns Promise<void>

### Protected deleteCredentials

- deleteCredentials(account: string): Promise<void>

- Overrides AbstractCredentialManager.deleteCredentials

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:188

  Calls the keytar deletePassword service with {@link DefaultCredentialManager#service} and the account passed to the function by Imperative.

  throws

    ImperativeError if keytar is not defined.

  #### Parameters

  - ##### account: string

    The account for which to delete the password

  #### Returns Promise<void>

  A promise that the function has completed.

### Private deleteCredentialsHelper

- deleteCredentialsHelper(account: string, keepCurrentSvc?: boolean): Promise<boolean>

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:345

  #### Parameters

  - ##### account: string

  - ##### Optional keepCurrentSvc: boolean

  #### Returns Promise<boolean>

### Private getCredentialsHelper

- getCredentialsHelper(service: string, account: string): Promise<SecureCredential>

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:293

  Helper to load credentials from vault that supports values longer than `DefaultCredentialManager.WIN32_CRED_MAX_STRING_LENGTH` on Windows.

  #### Parameters

  - ##### service: string

    The string service name.

  - ##### account: string

    The string account name.

  #### Returns Promise<SecureCredential>

  A promise for the credential string.

### Private getMissingEntryMessage

- getMissingEntryMessage(account: string): string

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:368

  #### Parameters

  - ##### account: string

  #### Returns string

### initialize

- initialize(): Promise<void>

- Overrides AbstractCredentialManager.initialize

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:149

  Called by CredentialManagerFactory.initialize before the freeze of the object. This gives us a chance to load keytar into the class before we are locked down. If a load failure occurs, we will store the error and throw it once a method of this class tries to execute. This prevents a missing keytar module from stopping all operation of the cli.

  In the future, we could go even further to have keytar load into a sub-object of this class so that the load doesn't hold up the main class execution.

  #### Returns Promise<void>

  A promise that the function has completed.

### load

- load(account: string, optional?: boolean): Promise<string>

- Inherited from AbstractCredentialManager.load

  - Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:112

  Load credentials for an account managed by the credential manager.

  #### Parameters

  - ##### account: string

    The account (or profile identifier) associated with credentials

  - ##### Optional optional: boolean

    Set to true if failure to find credentials should be ignored

  #### Returns Promise<string>

  The username and password associated with the account.

### Protected loadCredentials

- loadCredentials(account: string, optional?: boolean): Promise<SecureCredential>

- Overrides AbstractCredentialManager.loadCredentials

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:205

  Calls the keytar getPassword service with {@link DefaultCredentialManager#service} and the account passed to the function by Imperative.

  throws

    ImperativeError if keytar is not defined.

  throws

    ImperativeError when keytar.getPassword returns null or undefined.

  #### Parameters

  - ##### account: string

    The account for which to get credentials

  - ##### Optional optional: boolean

    Set to true if failure to find credentials should be ignored

  #### Returns Promise<SecureCredential>

  A promise containing the credentials stored in keytar.

### save

- save(account: string, secureValue: string): Promise<void>

- Inherited from AbstractCredentialManager.save

  - Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:132

  Save credentials for an account managed by the credential manager.

  throws

    ImperativeError - when the secure field is missing.

  #### Parameters

  - ##### account: string

    The account (or profile identifier) associated with credentials

  - ##### secureValue: string

    Value to be securely stored

  #### Returns Promise<void>

### Protected saveCredentials

- saveCredentials(account: string, credentials: SecureCredential): Promise<void>

- Overrides AbstractCredentialManager.saveCredentials

  - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:244

  Calls the keytar setPassword service with {@link DefaultCredentialManager#service} and the account and credentials passed to the function by Imperative.

  throws

    ImperativeError if keytar is not defined.

  #### Parameters

  - ##### account: string

    The account to set credentials

  - ##### credentials: SecureCredential

    The credentials to store

  #### Returns Promise<void>

  A promise that the function has completed.

### secureErrorDetails

- secureErrorDetails(): string | undefined

- Inherited from AbstractCredentialManager.secureErrorDetails

  - Defined in @zowe/imperative/src/security/src/abstract/AbstractCredentialManager.ts:148

  #### Returns string | undefined

  - Additional details for credential manager errors, if the current CredentialManager has provided any.

### Private setCredentialsHelper

- setCredentialsHelper(service: string, account: string, value: SecureCredential): Promise<void>

- - Defined in @zowe/imperative/src/security/src/DefaultCredentialManager.ts:326

  Helper to save credentials to vault that supports values longer than `DefaultCredentialManager.WIN32_CRED_MAX_STRING_LENGTH` on Windows.

  #### Parameters

  - ##### service: string

    The string service name.

  - ##### account: string

    The string account name.

  - ##### value: SecureCredential

    The string credential.

  #### Returns Promise<void>

Generated using TypeDoc