# Concelier connector credentials matrix

Sprint: SPRINT_20260505_026_Connectors_vendor_credentials_backlog.md task B-CRED-001. Source of truth: each connector’s *Options.cs and *DependencyInjectionRoutine.cs under src/Concelier/__Libraries/StellaOps.Concelier.Connector.<Vendor>/. Operator decisions (per-row enable / defer / decline) are captured in B-CRED-002 using this matrix as input.

Reference-based credentials — kill plaintext at rest (SPRINT_20260703_003)

Custody review P0 #2. Connector secret-bearing config fields (apiToken / subscriptionToken — GitHub PAT, Red Hat subscription token) now accept a secret reference (builtin://… / vault://… / openbao://…) instead of a plaintext token. The reference is resolved in-host through the unified ISecretProvider (ADR-031/032) by SecretProviderRemoteCredentialResolver — the chosen alternative to the Platform HTTP bridge (AddPlatformRemoteCredentialResolver), so a feed pull needs no runtime dependency on the Platform WebService (air-gap posture). It plugs into the SAME IRemoteCredentialResolver seam the overlays already consume (TryGetCached step 1); a plain literal value is left inline (back-compat).

• Scope: single-value connectors ghsa, redhat, redhat-csaf AND — since the 2026-07-04 composed-credential follow-up — composed-credential connectors (cisco/microsoft OAuth pair, cve triple). EACH composed field can independently hold a reference (e.g. clientSecret = vault://… while clientId stays plain); the resolver resolves the reference-bearing fields and composes the "{a}:{b}[:{c}]" plaintext the overlays already parse.
• Fail-closed: a recognised-but-unresolvable reference throws RemoteCredentialResolutionException. The fetch-job warm-up propagates it before the connector runs, while the overlay also refuses to copy a reference-shaped value verbatim (ConnectorSecretReference) on direct/non-job option reads.
• Seal-at-rest: ConnectorCredentialSealMigration (forward-only, idempotent) seals existing plaintext single-value secrets AND the SECRET half of composed credentials (Cisco/MSRC clientSecret, CVE apiKey) into the builtin store and rewrites the config field to a builtin:// reference; the non-secret identifiers (clientId/tenantId/apiOrg/apiUser) stay plain. A post-pass sweep proves no plaintext secret remains.
• Code: src/Concelier/__Libraries/StellaOps.Concelier.Connector.Common/Credentials/ — SecretProviderRemoteCredentialResolver.cs, ConnectorCredentialSealMigration.cs, ConnectorSecretReference.cs, RemoteCredentialResolverServiceCollectionExtensions.AddSecretProviderRemoteCredentialResolver.
• Operations: docs/runbooks/concelier-connector-operations.md → “Reference-based connector credentials”.

Platform credential store wiring (RFC-0001 §8.2)

The five credentialed connectors below resolve through the Platform store via IRemoteCredentialResolver (precedence step 1) ahead of env-var / source-config (step 2) and the connector’s natural fallback (step 3). All wiring landed under SPRINT_20260512_021 TASK-021-03/07 and the per-vendor verification sprints 052/053/054/055.

Resolver invariants:

• Synchronous TryGetCached(connectorId, tenantId, out cached) path inside IPostConfigureOptions<T>.PostConfigure — never blocks on HTTP.
• Each GHSA/CVE/Cisco/MSRC/Red Hat fetch job warms the resolver before reading options or creating its HTTP client, using the envelope tenant or the background storage DefaultTenant; after resolution it invalidates the connector’s typed/HTTP option caches so the first pull consumes the resolved value.
• Valkey connector-credentials-changed channel invalidates the in-process cache on rotation (best-effort; degrades gracefully to 30 s TTL on single-node installs without Valkey).
• Untenanted ticks skip step 1 (RFC §4) and fall straight to step 2.
• concelier:credentials:dry-run scope governs the vendor-API probe (Sprint 512_032 — GHSA + Cisco only today; others return 501).

Reading the env-var column

Concelier services bind configuration through AddStellaOpsDefaults with EnvironmentPrefix = "CONCELIER_" (src/Concelier/StellaOps.Concelier.WebService/Program.cs:142). Standard .NET IConfiguration rules apply, so a config key concelier:sources:cisco:ClientId resolves from environment variable:

CONCELIER_concelier__sources__cisco__ClientId

(env prefix CONCELIER_, then the section path with : replaced by __). Equivalently you can set it under etc/concelier.yaml as concelier.sources.cisco.clientId. The matrix lists the config key (left of =) — operators wire the matching env var.

Geo / export-control note

Rows tagged geo: classified (e.g. fstec-bdu, nkcki) ingest from feeds operated by sanctioned or restricted entities. Enabling them requires legal/export-control review (EAR/OFAC, EU dual-use, local equivalents) before a credential or a route reaches production. The B-CRED-002 operator decision step must not override classified rows without sign-off captured in the sprint Decisions & Risks log.

How to read “auth mechanism”

• none-public — no credential; the connector scrapes a public HTML/RSS/Atom/JSON feed. The “AUTH-SKIPPED” label from CYCLE-007 for these rows means the feed itself is unreachable from the deployment network, not that an API key is missing. Operator decision is a network/policy call, not a credential acquisition.
• OSV-alias — the connector is an attribution alias only. Real ingestion is performed by the OSV connector (source key osv) which routes by ecosystem tag. No credential is needed; rows with enabled=false exist so operators can suppress that ecosystem from policy/UI.
• GHSA-filter - the row is an operator-visible package ecosystem filter over GitHub Security Advisory data. Real ingestion is performed by ghsa.
• canonical-alias - the row is kept for filtering and attribution, but coverage is served by a canonical source key such as redhat or microsoft.
• PAT-optional — public API access works anonymously, while an optional personal/application token can raise rate limits or support enterprise routing.
• PAT — long-lived personal/application token, sent in Authorization: token … or similar.
• OAuth2 client_credentials — confidential-client flow exchanging a clientId/clientSecret for short-lived bearer tokens.
• API key — opaque shared secret bound to a registered organisation/user.

Vendor advisories

Cloud-platform coverage

AWS and GCP have no-credential public fetchers. The standalone azure connector was removed (2026-06-25) — it was an intentional no-op that produced 0 advisories; Azure CVEs are ingested by microsoft/MSRC. The seeded azure catalog row (enabled=false) remains for attribution/policy filtering only. See ../connector-disposition.md.

CERTs

ICS / national CIS sources

Primary databases (mixed — included for completeness because CYCLE-007 surfaced cve as AUTH-SKIPPED)

Ecosystem aliases (OSV-routed — no credential needed)

These connectors are alias-only. Data ingestion is performed by Connector.Osv (source key osv), and the alias rows exist so operators can enable/disable per ecosystem from policy/UI and so attribution maps records to the correct source key. No credential is required, and “AUTH-SKIPPED” in CYCLE-007 reflects that they intentionally produce zero direct rows; counts come through the OSV connector.

Removed legacy advisory sources

• arm was removed in Sprint 20260601_001 because the former production backend failed closed and no approved machine-readable Arm advisory feed has been identified. Fresh startup migrations remove existing vuln.sources, mirror-domain, and project references.

MITRE knowledge bases

Removed under PM Path 2 decision (Sprint 20260513_008, CON-MITRE-004). The Connector.MitreAttack and Connector.MitreD3fend libraries, tests, plugin manifests, and vuln.sources seed rows have all been deleted. The SourceDefinition static fields for mitre-attack / mitre-d3fend have been removed from src/Concelier/__Libraries/StellaOps.Concelier.Core/Sources/SourceDefinitions.cs. The consolidated baseline 001_v1_concelier_baseline.sql purges any rows left behind by the old MITRE seed and by the stella-public-cache mirror domain (the purge blocks at lines 2503-2550, folded in from the pre-1.0 028_remove_mitre_seed_sources.sql and 029_remove_mitre_from_mirror_domain.sql, which are archived and no longer embedded). Design proposal: docs/architecture/proposal-mitre-d3fend-scope.md.

Summary by mechanism

• PAT-optional (1): ghsa.
• OAuth2 client_credentials (2): microsoft, cisco.
• API key (0 required): cve keeps optional CVE Services credentials, but public mirror bootstrap uses cvelistV5 without credentials and can consume an operator-supplied baseline zip before the rolling delta feed; it still accepts an offline SeedDirectory fallback.
• none-public (19): cve, oracle, adobe, chromium, apple, vmware, siemens, intel, amd, aws, azure, gcp, cccs, jpcert, krcert, cert-de, cert-fr, cert-in, plus the three classified-geo Russian/ICS feeds (kaspersky-ics, fstec-bdu, nkcki).
• OSV-alias (6): hex, packagist, pypa, rubygems, rustsec, bundler-audit.
• classified geo (3): kaspersky-ics, fstec-bdu, nkcki — block on B-CRED-002 export-control review.
• parent/canonical coverage: OSV-alias ecosystems are covered by osv; nuget is covered by ghsa; rhel is covered by redhat; azure is covered by microsoft/MSRC.
• direct implementation gaps: amd and siemens remain tracked separately from parent-covered aliases until their production fetcher status is fully closed out. aws and gcp now have real fetchers.
• connector source not found (0): mitre-attack and mitre-d3fend previously listed here, then implemented by Sprint 046, then removed in Sprint 20260513_008 under PM Path 2 decision (zero downstream consumers; see docs/architecture/proposal-mitre-d3fend-scope.md).

The CYCLE-007 “AUTH-SKIPPED” label therefore actually splits three ways for B-CRED-002:

1. True credential gap (2 rows): microsoft, cisco.
2. Network/geo policy gap (no credential needed) (10 rows): oracle, adobe, chromium, apple, vmware, cccs, jpcert, krcert, cert-de, cert-fr, cert-in, plus classified kaspersky-ics, fstec-bdu, nkcki.
3. Implementation gap vs parent coverage: amd and siemens are direct implementation gaps; azure, rhel, nuget, and OSV ecosystem rows are parent/canonical coverage rows whose counts properly belong to microsoft, redhat, ghsa, or osv.

B-CRED-002 should split its operator decisions accordingly: only category (1) is unblocked by acquiring a credential. Categories (2) and (3) need network-policy and implementation-sprint decisions respectively.