Plugins
OpenKCM connects to keystores, user directories and other external systems through plugins. A plugin runs as a separate process and talks to its host service over gRPC, using HashiCorp go-plugin. The interfaces are defined in the plugin SDK.
For configuration examples of every plugin, see CMK plugin configuration.
Plugin interfaces
| Interface | Operations | Used by |
|---|---|---|
| Keystore operations | Create, get, enable, disable and delete keys, list key versions, get import parameters, import key material, validate keys and access data | CMK |
| Keystore management | Create and delete keystores, grant and remove trust | CMK |
| Identity management | Get users and groups, list a group's users and a user's groups | CMK |
| Notification | Send notifications | CMK |
| System information | Get information about a system | CMK |
| Certificate issuer | Get a certificate | CMK |
Keystore plugins
Repository: openkcm/keystore-plugins
| Plugin | Provider | Key types |
|---|---|---|
keystoreop/aws | AWS KMS | BYOK and HYOK |
- BYOK keys are created without key material. CMK then gets the import parameters from AWS KMS and imports the customer's wrapped key material.
- HYOK keys stay in the customer's own AWS account. CMK reads their state with the access data the customer provides.
Plugins for other providers can be built against the keystore operations interface.
Identity management plugins
Repository: openkcm/identity-management-plugins
| Plugin | Source of users and groups |
|---|---|
scim | Any SCIM 2.0 directory |
scim-static | Users and groups defined inline in the plugin configuration, for tests and demos |
The scim plugin authenticates to the directory with basic authentication or mutual TLS. In a multi-tenant installation, it selects the directory host and request headers for each request from the caller's authentication context, so each tenant can use its own directory.
CMK uses these plugins to check that a group exists before it maps the group to a role, and to find the approvers of a workflow. See CMK authorization.
Distribution
Plugins are built as standalone binaries. The CMK container image includes the keystore plugins, and plugin builds can be published as OCI artifacts.