Cryptographic Material

Some Unifiers, which finalize the successful execution of the pipeline, can generated signed objects, like a JWT, to be forwarded to the upstream services. In such cases Heimdall acts as an issuer of such objects and needs at least corresponding key material.

Configuration

The configuration related to the issuance of signed objects can be done using the signer property, which resides on the top level of heimdall’s configuration and supports the following properties.

name: string (optional)
The name used to specify the issuer. E.g. if a JWT is generated, this value is used to set the iss claim. If not set, the value heimdall is used.
key_store: Key Store (optional)
The key store containing the cryptographic material. If configured, at least one private key and the corresponding certificate must be present. If not configured, heimdall generates an ECDSA P-384 key pair on start up and uses it then.
You should always configure a valid key store for production use!
key_id: string (optional)
If the key_store contains multiple keys, this property can be used to specify the key to use (see also Key-Id Lookup). If not specified, the first key is used. If specified, but there is no key for the given key id present, an error is raised and heimdall will refuse to start.

Example 1. Possible configuration

Imagine you have a PEM file located in /opt/heimdall/keystore.pem with the following contents:

Then you can configure heimdall to use it like follows:

signer:
  name: foobar
  key_store:
    path: /opt/heimdall/keystore.pem
  key_id: foo

Last updated on Jan 5, 2023

Rule Providers

Configuration Types