Come together with the global Drupal community in Rotterdam, 28 Sept – 1 Oct 2026. Sessions, contribution, connection, and Early Bird savings until 8 June.Problem/Motivation
Right now, Key doesn't natively integrate with Encrypt. If you have an encryption key already set up (see #3561668: Add the ability for the Encryption key type to automatically generate the encryption key in a file for where we're trying to make that happen in Key), there is no way to store a key encrypted automatically, with automatic decryption. You pretty much have to write your own key provider, as far as I'm aware.
Proposed resolution
Introduce a new key provider plugin, called encrypted or something similar. The new provider would take two configuration options:
encryption_profile: ID_OF_ENCRYPTION_PROFILE
value: ENCRYPTED_VALUE
If the configured encryption profile doesn't exist, the provider will throw an exception. This makes sense -- it cannot possibly access encrypted credentials with an encryption profile.
An alternate approach would be to introduce a trait for this behavior and override some of Key's built-in providers so that they use the trait. To me that would be a more complex and messier implementation.
User interface changes
No changes, but a new key provider would be introduced with its own configuration form.
API changes
None.
Data model changes
None.
Issue fork encrypt-3561674
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
- 3561674-add-a-key
changes, plain diff MR !18 - 3561674-support-encryption compare
1 hidden branch
Issue fork key-3561674
Show commands
Start within a Git clone of the project using the version control instructions.
Or, if you do not have SSH keys set up on git.drupalcode.org:
Comments
Comment #2
phenaproximaComment #3
phenaproximaComment #5
phenaproximaNeeds tests, but I have an initial implementation. To keep things simple, I changed it to be a hard-coded decorator of the
configkey provider, which is the simplest and needs no additional configuration.Comment #6
phenaproximaComment #7
phenaproximaAfter more thought and experimentation, I think the best way to have this work is actually to have the Key module support Encrypt natively, but optionally, and with only one key provider:
config. If the data is encrypted, then it doesn't matter if it's stored in the entity -- it's encrypted.Assigning to myself to update the MR and issue summary.
Comment #12
mxr576Comment #13
mxr576Removed the outdated part from the IS, Drupal CMS is going to rely on a different solution provided by Easy Encryption module.