Mendix integration with Azure Key vault

0
Hi All,   I would like to Integrate Mendix with Azure key vault to store app secrets.  Is there any documentation or steps ?
asked
3 answers
2

I am nit aware of any documentation or step by step guide for key vault in Mendix. You can either integrate via REST or build java actions with their SDK, see https://docs.microsoft.com/en-us/azure/key-vault/general/developers-guide

answered
0

Hi Mohamed,

Yes, you can integrate Mendix with Azure Key Vault, but the recommended approach depends on your Mendix hosting environment and how the secrets will be used.

Option 1: Private Mendix Platform — recommended for environment secrets

If your application runs on a supported Private Mendix Platform deployment on Azure Kubernetes Service (AKS), Mendix provides a documented Azure Key Vault integration.

The general setup is:

  1. Create an Azure Key Vault: Create the vault in Azure and configure Azure RBAC as the permission model.

  2. Configure managed identity: Set up the required User-Assigned Managed Identity and Azure Workload Identity federation.

  3. Grant permissions: Assign the appropriate Key Vault roles to the identities used by the platform and application environment.

  4. Configure the secret store: Enable the supported external secret-store integration and configure the required CSI driver and SecretProviderClass.

  5. Configure your secrets: Map supported Mendix application constants and runtime settings to the corresponding Key Vault secrets through the platform configuration.

  6. Restart and validate: Restart the environment when required and verify that the application can access the configured values.

This approach allows supported environment-specific secrets to be stored in Azure Key Vault instead of being stored as ordinary values in the platform database.

Option 2: Retrieve secrets from Azure Key Vault at runtime

If your Mendix application needs to retrieve a secret dynamically—for example, an API key for an external service—you can implement an integration with Azure Key Vault.

A typical flow is:

  1. Configure an appropriate identity for the application.

  2. Grant that identity permission to read only the required secrets.

  3. Authenticate to Azure using a supported mechanism, preferably managed identity where the hosting environment supports it.

  4. Call the Azure Key Vault REST API or use a suitable Java integration to retrieve the secret.

  5. Use the secret in the required operation without exposing it in the UI, logs, or persistent application data.

The exact authentication setup depends on your hosting environment. Do not assume that an application deployed on standard Mendix Cloud automatically has an Azure managed identity.

Important security considerations

  • Never hardcode API keys, passwords, or client secrets in microflows or Java actions.

  • Do not store sensitive credentials in ordinary Mendix entities just to make them configurable.

  • Apply least-privilege access and use separate vaults or permissions for different environments where appropriate.

  • Avoid logging secret values or returning them to the browser.

  • Plan for secret rotation and access auditing.

Official references:

One clarification: Is your application hosted on standard Mendix Cloud, Private Mendix Platform on AKS, or your own Azure infrastructure? Also, do you want to store Mendix constants or retrieve API keys dynamically at runtime? Those details determine the exact supported implementation.

Hope this helps! If you find this answer helpful, please mark it as the accepted answer.

answered
0

Hi Mohamed,

Yes, Mendix supports integrating with Azure Key Vault, but the implementation depends on where your Mendix application is hosted and which secrets you want to manage.

1. For Mendix applications deployed on Mendix Cloud

If you need to retrieve application-specific secrets dynamically from Azure Key Vault at runtime, you can integrate through Azure's authentication and Key Vault APIs. Use an appropriate authentication method, such as a Microsoft Entra ID application or managed identity where supported by the hosting environment. Store credentials securely and avoid hardcoding client secrets in the application.

2. For Mendix applications deployed on a private Kubernetes platform

Mendix supports external secret management using Azure Key Vault and the Secrets Store CSI Driver. This can be used for environment-sensitive configuration such as application constants and runtime settings, depending on the platform configuration.

Official Mendix documentation:

Could you clarify whether your application is deployed on Mendix Cloud, a private Mendix Kubernetes platform, or Azure App Service/another hosting environment? Also, are you planning to store application constants, database credentials, or API secrets?

With those details, the appropriate integration approach can be identified.

Hope this helps! If you find this answer helpful, please mark it as the accepted answer.

answered