DataConverter - Convert/Encrypt certain fields only and not the whole payload

Community Support
1

Hello,

Can DataConverter be used to encrypt only certain fields from a workflow definition like password/token etc instead of the whole payload which is stored in the Temporal database?

Thank you

3

Hello @anmanz

Yes, you can implement your DataConverter to encrypt the values of only a few fields.

The implementation is on your side. For it I guess, in the Encode function you need to figure out the data structure first and then encrypt/decrypt only the fields you want.

4

Hello. May I have a sample of this use case? In Go Lang. Thank you a lot

5

Hello @anmanz

I will work on it.

I am not a go expert, but in the encode method you should be able to get p.Data (which is the input parameter) and encrypt only the fields you are interested in. Same when decoding

6

Hello,

Can I have an example of how can encrypt only certain field (secret) from the second payload? Since we have two json payloads here? And by default it encrypts based on a loop for all the payloads in the array? Appreciate any help will be provided as soon as possible.

[
  {
    "path": "restconf/data/devices/device=device-0/config"
  },
  {
    "resource": {
      "scheme": "http",
      "host": "127.0.0.1",
      "port": 18080
    },
    "secret": {
      "userAndPass": {
        "username": "user",
        "password": "pass"
      }
    }
  }
]

Thank you,
Andrei

7

1st thing you want to do is implement the temporal data converter interface and implement it’s methods

type DataConverter struct{ converter.DataConverter encrypterDecrypter ED }

In the ToPayloads method, encrypt selective fields using reflection and ED object in your data converter struct

In the FromPayloads method, decrypt the encrypted fields using reflect and ED object in your struct

Initialise your temporal client with this data converter object:

temporalClient, err := client.Dial(client.Options{
    DataConverter: dataConverter,
})

Encryption/Decryption using reflection: Golang: The Art of Reflection – Nutanix.dev
Note: This can be modified to be done based on a tag value in struct field rather than using a field of sensitive keys.

8

Hello Mridul,

Can you give me an example for the payload I gave? Maybe won’t be in the client, maybe will be on the worker side.

Thank you,
Andrei