---
title: "Storing Connections"
canonical: "https://docs.vaultspeed.com/space/VPD/3291381934/Storing%20Connections"
format: markdown
---
The VaultSpeed Agent supports multiple methods for storing the connection properties, with varying levels of security.

> Macro (toc)

## File (default)

All your connections will be stored in a single file. Access can be limited by using file permissions.

#### Configuration

To use this storage method, add the following properties to the `client.properties` file in your VaultSpeed Agent configuration:

- **Connection Provider**:  
`conn.provider=file`  
*(This is the default, so it may not be strictly necessary to include this line.)*
- **Connections File Path**:  
`conn.file=/home/agent/connections.properties`  
*(This property should point to the file containing all the connection details, and it is present in the default agent configuration.)*

The connections file should follow this format:

```
<connection_name1>.<property_name1> = "<value>"
<connection_name1>.<property_name2> = "<value>"

<connection_name2>.<property_name1> = "<value>"
```

> 📝 #### Security Note
> 📝 
> 📝 Ensure that file permissions are properly configured to restrict access to authorized users only, in line with your system's security policies.

## Directory

Each connection will be stored in its own file in a certain directory. Access can be limited to each connection separately by using file permissions. Make sure that the user running the agent can access all of them.

To use this storage method, the following properties should be present in the client.properties file of your Agent.

```
conn.provider=directory
# This property should contain the path to the directory where all the connection files are stored 
conn.dir = /home/agent/connections
```

Each connection file in the directory should be named: `<connection_name>.properties`.  
The content of the file should look like this:

```
<property_name1> = "<value>"
<property_name2> = "<value>"
```

> 📝 When using Oracle connections, make sure the entire connection string is in 1 property.  Sqlplus can’t handle the username/password being in separate properties.

## Azure Key Vault

The connections will be stored as secrets in an Azure Key Vault. Access is managed using Azure Identity and Access Management (IAM) policies, providing robust security for sensitive data.

**Use case:** This method is ideal for cloud environments that require centralized secret management with strong access control.

### Build the Content of Your Secret

Before using Azure Key Vault to store connections, follow these steps:

1. **Create a Key Vault** in Azure.
  1. **NOTE:** Under Settings → Access configuration → Permission model should be set as Vault access policy

![image-20250109-151706.png](media://273ed482-fdad-44df-bcb5-376bc5e0c8c4)

2. **Add your database connections** as secrets in the Key Vault.

- The **secret name** in the Key Vault must match the connection name in VaultSpeed.
- The **secret value** should be a JSON string containing the connection properties.

The JSON structure should look like this:

```
{
  "<property_name1>": "<value>",
  "<property_name2>": "<value>"
}
```

> 📝 **Note:** Only the following properties are read and interpreted from the JSON:
> 📝 
> 📝 - `url`
> 📝 - `user`
> 📝 - `password`
> 📝 
> 📝 All other parameters required for the connection setup should be included in the `url` string.

For example, when setting up a Snowflake connection, the warehouse and database definitions should be included in the `url` parameter:

```
{ 
  "url":"jdbc:snowflake://<snowflake environment>.snowflakecomputing.com?warehouse=<your warehouse>&db=<your database>",
  "user":"<your user>",
  "password":"<your password>"
}
```

### Configure Your Secret

To configure VaultSpeed to use Azure Key Vault for storing connections, add the following properties to the `client.properties` file of your Agent:

- **Connection Provider**:  
`conn.provider=azure`
- **Key Vault URL**:  
`conn.url=https://<key_vault_name>.vault.azure.net/`

#### Create the Secret in Azure Key Vault

To create and store your database connection secrets in Azure Key Vault, follow these steps:

1. **Navigate to your Key Vault** in Azure and select **Secrets** from the **Settings** section:

![image](media://4279e342-0aea-45bd-bb0a-85a47ab54f15)

2. On the **Create a secret** page, fill out the **Name** field with your connection name (e.g., `myDatabaseConnection`) and input your connection properties in the **Value** field as a JSON string:

![image](media://2499c971-6cdc-4ba0-b70e-1a698bcd61c3)

Once the secret is saved, VaultSpeed will retrieve the connection information from this stored secret during runtime, using the settings provided in the `client.properties` file.

To use this storage method in VaultSpeed, the following properties should be present in the client.properties file of your Agent.

```
conn.provider=azure
# This property should contain the url of your key vault.
conn.url=https://<key_vault_name>.vault.azure.net/
```

#### Authentication

Authentication between the VaultSpeed Agent and Azure is managed outside the Agent. Several authentication methods are available:  
[https://docs.microsoft.com/en-us/azure/developer/java/sdk/identity-azure-hosted-auth](https://docs.microsoft.com/en-us/azure/developer/java/sdk/identity-azure-hosted-auth) 

- **Environment variables**
- **Azure Managed Identity**
- **Shared token cache**
- **Azure CLI**

For example, to authenticate using environment variables, set the following before starting the Agent:

```
export AZURE_CLIENT_ID=<your_client_id>
export AZURE_CLIENT_SECRET=<your_automation_account_client_secret>
export AZURE_TENANT_ID=<your_tenant_id>
```

## Java Key Store

The connections will be stored as secrets in a Java Key Store file. Access is limited by default.

To create a Java Key Store execute the following command, just fill in the `<key_store_name>`:

<details>
<summary>Windows</summary>

`"C:\Program Files (x86)\Java\jdk1.8.0_291\bin\keytool.exe" -genkey -alias vs_conn -keystore <key_store_name>.p12 -storetype pkcs12`
</details>

<details>
<summary>MacOs - Unix</summary>

`keytool -genkey -alias vs_conn -keystore <key_store_name>.p12 -storetype pkcs12`
</details>

This will create your Keystore file in the current folder where you invoke the command.


To use this storage method, the following properties should be present in the client.properties file of your Agent.

```
conn.provider=java
# Path to the Java Key Store file
conn.path=/home/agent/<key_store_name>.p12
# password of the keystore. 
# If this is not present, it will try the environment variable "vs_agent_conn_password" instead
conn.password=abcdef
# Path to the connection ingestion directory
conn.dir = /home/agent/connections
```

It is recommended to keep the password for the key store secret and only allow admins to know it. This password allows reading and writing to the entire Keystore.

Developers can now add connections by creating a connection file in the directory defined in the client.properties file (`conn.dir`).  The Agent will constantly scan this directory for files, when it finds one, it will store the properties in the Key Store and delete the file.  
This means that developers cannot see what connections are stored in the Key Store and what their properties are.

Each connection file in the ingestion directory should be named: `<connection_name>.properties`.  
The content of the file should look like this:

```
<property_name1> = "<value>"
<property_name2> = "<value>"
```

To update an existing connection, you can create a new file with the same name as the existing connection and place it in the ingestion directory.  It will overwrite the stored information in the Keystore upon ingestion.