[Feature Request] Ability to specify fields to be masked in database/config output.

[sebinjohn]

Is your feature request related to a problem? Please describe.
In a database plugin if root credential can't be specified in password field, it will not be masked in the output of vault read database/config/:name
More context:
My organization has internally developed a database plugin to create Artifactory token as a dynamic secret in Vault. Due to organizational constraints an API Key is used instead of admin username and password to create tokens dynamically.

The plugin is configured as below.

$ vault write database/config/artifactory \
  plugin_name="artifactory-plugin" \
  allowed_roles="test-role" \
  api_key="AKCp5e3p2H33kNaZf6TXBqbKXQsHYM3UCEfWbgVhFticKAa8bYsF2gMMM3gw1a6GmopFDqKta" \
  address="http://localhost:8000/artifactory" \

The config would look like

$ vault read -format=json database/config/artifactory | jq -r .data.connection_details
{
  "address": "http://localhost:8000/artifactory",
  "api_key": "AKCp5e3p2H33kNaZf6TXBqbKXQsHYM3UCEfWbgVhFticKAa8bYsF2gMMM3gw1a6GmopFDqKta"
}

Describe the solution you'd like
have a field in the database/config/:name to specify which field should be masked in the config output.
eg:

$ vault write database/config/artifactory  \
    plugin_name=... \
    allowed_roles=... \
    address=... \
    api_key=... \
    mask=api_key

and database/config/:name output will be

$ vault read -format=json database/config/artifactory | jq -r .data.connection_details
{
  "address": "http://localhost:8000/artifactory"
}

[catsby]

Hello - as a workaround, is it possible to rename the api_key to password in the custom plugin? I believe that will get the desired effect, at the cost of a slight misnomer.

Long term, this seems like something that can be accomplished as you describe, though I would probably remove the sensitive keys instead of masking them. Adding a filter_keys type configuration variable that accepts a comma separated string, could then be used to filter out those keys from the ConnectionDetails map where the custom keys and data reside:

• vault/builtin/logical/database/path_config_connection.go

  Line 203 in 4887172

  delete(config.ConnectionDetails, "password")

[sebinjohn]

@catsby Yes. I will be implementing this workaround.