Package com.mongodb

Class ClientEncryptionSettings

java.lang.Object
com.mongodb.ClientEncryptionSettings
public final class ClientEncryptionSettings extends Object
The client-side settings for data key creation and explicit encryption.

Explicit encryption/decryption is a community feature, enabled with the new com.mongodb.client.vault.ClientEncryption type, for which this is the settings.

Since:
3.11

  • Method Details

    • builder

      public static ClientEncryptionSettings.Builder builder()
      Convenience method to create a Builder.
      Returns:
      a builder

    • getKeyVaultMongoClientSettings

      public MongoClientSettings getKeyVaultMongoClientSettings()
      Gets the MongoClientSettings that will be used to access the key vault.
      Returns:
      the key vault settings, which may be not be null

    • getKeyVaultNamespace

      public String getKeyVaultNamespace()
      Gets the key vault namespace.

      The key vault namespace refers to a collection that contains all data keys used for encryption and decryption (aka the key vault collection). Data keys are stored as documents in a special MongoDB collection. Data keys are protected with encryption by a KMS provider (AWS, Azure, GCP KMS or a local master key).

      Returns:
      the key vault namespace, which may not be null

    • getKmsProviders

      public Map<String,Map<String,Object>> getKmsProviders()
      Gets the map of KMS provider properties.

      Multiple KMS providers can be specified within this map. Each KMS provider is identified by a unique key. Keys are formatted as either "KMS provider type" or "KMS provider type:KMS provider name" (e.g., "aws" or "aws:myname"). The KMS provider name must only contain alphanumeric characters (a-z, A-Z, 0-9), underscores (_), and must not be empty.

      Supported KMS provider types include "aws", "azure", "gcp", and "local". The provider name is optional and allows for the configuration of multiple providers of the same type under different names (e.g., "aws:name1" and "aws:name2" could represent different AWS accounts).

      The kmsProviders map values differ by provider type. The following properties are supported for each provider type:

      For "aws", the properties are:

      • accessKeyId: a String, the AWS access key identifier
      • secretAccessKey: a String, the AWS secret access key
      • sessionToken: an optional String, the AWS session token

      For "azure", the properties are:

      • tenantId: a String, the tenantId that identifies the organization for the account.
      • clientId: a String, the clientId to authenticate a registered application.
      • clientSecret: a String, the client secret to authenticate a registered application.
      • identityPlatformEndpoint: optional String, a host with optional port. e.g. "example.com" or "example.com:443". Generally used for private Azure instances.

      For "gcp", the properties are:

      • email: a String, the service account email to authenticate.
      • privateKey: a String or byte[], the encoded PKCS#8 encrypted key
      • endpoint: optional String, a host with optional port. e.g. "example.com" or "example.com:443".

      For "kmip", the properties are:

      • endpoint: a String, the endpoint as a host with required port. e.g. "example.com:443".

      For "local", the properties are:

      • key: byte[] of length 96, the local key

      It is also permitted for the value of a kms provider to be an empty map, in which case the driver will first

      However, KMS providers containing a name (e.g., "aws:myname") do not support dynamically obtaining KMS properties from the Supplier or environment.
      Returns:
      map of KMS provider properties
      See Also:

    • getKmsProviderPropertySuppliers

      public Map<String,Supplier<Map<String,Object>>> getKmsProviderPropertySuppliers()
      This method is similar to getKmsProviders(), but instead of getting properties for KMS providers, it gets Suppliers of properties.

      If getKmsProviders() returns empty properties for a KMS provider, the driver will use a Supplier of properties configured for the KMS provider to obtain non-empty properties.

      Returns:
      A Map where keys identify KMS providers, and values specify Suppliers of properties for the KMS providers.
      Since:
      4.6

    • getKmsProviderSslContextMap

      public Map<String,SSLContext> getKmsProviderSslContextMap()
      Gets the KMS provider to SSLContext map.

      If a KMS provider is mapped to a non-null SSLContext, the context will be used to establish a TLS connection to the KMS. Otherwise, the default context will be used.

      Returns:
      the KMS provider to SSLContext map
      Since:
      4.4

    • getTimeout

      @Alpha(CLIENT) @Nullable public Long getTimeout(TimeUnit timeUnit)
      The time limit for the full execution of an operation.

      If set the following deprecated options will be ignored: waitQueueTimeoutMS, socketTimeoutMS, wTimeoutMS, maxTimeMS and maxCommitTimeMS

      • null means that the timeout mechanism for operations will defer to using:
        • waitQueueTimeoutMS: The maximum wait time in milliseconds that a thread may wait for a connection to become available
        • socketTimeoutMS: How long a send or receive on a socket can take before timing out.
        • wTimeoutMS: How long the server will wait for the write concern to be fulfilled before timing out.
        • maxTimeMS: The cumulative time limit for processing operations on a cursor. See: cursor.maxTimeMS.
        • maxCommitTimeMS: The maximum amount of time to allow a single commitTransaction command to execute. See: TransactionOptions.getMaxCommitTime(java.util.concurrent.TimeUnit).
      • 0 means infinite timeout.
      • > 0 The time limit to use for the full execution of an operation.
      Parameters:
      timeUnit - the time unit
      Returns:
      the timeout in the given time unit
      Since:
      5.2