(Quick Reference)

9.5 1Password Secrets Automation

Version: 5.1.0-SNAPSHOT

9.5 1Password Secrets Automation

1Password Secrets Automation can supply Micronaut Security secrets without adding a 1Password client to the application. Use 1Password Secrets Automation or 1Password Connect to manage the secret lifecycle, then expose the required values to the Micronaut application as normal configuration, such as environment variables or Kubernetes secrets.

Micronaut Security does not call the 1Password Connect API directly for this integration. It reads the same configuration properties it already supports, and the deployment environment is responsible for resolving 1Password-managed values before the application starts.

See the 1Password documentation for the secret-management side of this setup:

OAuth 2.0 Client Secrets

Store OAuth client secrets in 1Password, inject them into the runtime environment, and reference the injected values from the existing OAuth 2.0 client configuration.

micronaut.security.oauth2.clients.github.client-id=${OAUTH_CLIENT_ID}
micronaut.security.oauth2.clients.github.client-secret=${OAUTH_CLIENT_SECRET}
micronaut.security.oauth2.clients.github.authorization.url=https://github.com/login/oauth/authorize
micronaut.security.oauth2.clients.github.token.url=https://github.com/login/oauth/access_token
micronaut.security.oauth2.clients.github.token.auth-method=client-secret-post

micronaut:
  security:
    oauth2:
      clients:
        github:
          client-id: ${OAUTH_CLIENT_ID}
          client-secret: ${OAUTH_CLIENT_SECRET}
          authorization:
            url: https://github.com/login/oauth/authorize
          token:
            url: https://github.com/login/oauth/access_token
            auth-method: client-secret-post

[micronaut]
  [micronaut.security]
    [micronaut.security.oauth2]
      [micronaut.security.oauth2.clients]
        [micronaut.security.oauth2.clients.github]
          client-id="${OAUTH_CLIENT_ID}"
          client-secret="${OAUTH_CLIENT_SECRET}"
          [micronaut.security.oauth2.clients.github.authorization]
            url="https://github.com/login/oauth/authorize"
          [micronaut.security.oauth2.clients.github.token]
            url="https://github.com/login/oauth/access_token"
            auth-method="client-secret-post"

micronaut {
  security {
    oauth2 {
      clients {
        github {
          clientId = "${OAUTH_CLIENT_ID}"
          clientSecret = "${OAUTH_CLIENT_SECRET}"
          authorization {
            url = "https://github.com/login/oauth/authorize"
          }
          token {
            url = "https://github.com/login/oauth/access_token"
            authMethod = "client-secret-post"
          }
        }
      }
    }
  }
}

{
  micronaut {
    security {
      oauth2 {
        clients {
          github {
            client-id = "${OAUTH_CLIENT_ID}"
            client-secret = "${OAUTH_CLIENT_SECRET}"
            authorization {
              url = "https://github.com/login/oauth/authorize"
            }
            token {
              url = "https://github.com/login/oauth/access_token"
              auth-method = "client-secret-post"
            }
          }
        }
      }
    }
  }
}

{
  "micronaut": {
    "security": {
      "oauth2": {
        "clients": {
          "github": {
            "client-id": "${OAUTH_CLIENT_ID}",
            "client-secret": "${OAUTH_CLIENT_SECRET}",
            "authorization": {
              "url": "https://github.com/login/oauth/authorize"
            },
            "token": {
              "url": "https://github.com/login/oauth/access_token",
              "auth-method": "client-secret-post"
            }
          }
        }
      }
    }
  }
}

For Kubernetes deployments, expose the materialized secret as environment variables and keep the application configuration unchanged.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: example
spec:
  template:
    spec:
      containers:
        - name: app
          image: example/app:latest
          env:
            - name: OAUTH_CLIENT_ID
              valueFrom:
                secretKeyRef:
                  name: micronaut-security-secrets
                  key: oauth-client-id
            - name: OAUTH_CLIENT_SECRET
              valueFrom:
                secretKeyRef:
                  name: micronaut-security-secrets
                  key: oauth-client-secret

The Kubernetes Secret can be created or synchronized by the 1Password component you use in your cluster. Do not commit OAuth client secrets, 1Password Connect tokens, or op:// references that reveal vault, item, or field structure beyond what your deployment policy allows.

JWT Signing Secrets

The same pattern works for JWT signing secrets. Keep the secret value in 1Password and inject it into the environment before Micronaut Security creates the JWT signature configuration.

micronaut.security.token.jwt.signatures.secret.generator.secret=${JWT_GENERATOR_SECRET}
micronaut.security.token.jwt.signatures.secret.generator.jws-algorithm=HS256

micronaut:
  security:
    token:
      jwt:
        signatures:
          secret:
            generator:
              secret: ${JWT_GENERATOR_SECRET}
              jws-algorithm: HS256

[micronaut]
  [micronaut.security]
    [micronaut.security.token]
      [micronaut.security.token.jwt]
        [micronaut.security.token.jwt.signatures]
          [micronaut.security.token.jwt.signatures.secret]
            [micronaut.security.token.jwt.signatures.secret.generator]
              secret="${JWT_GENERATOR_SECRET}"
              jws-algorithm="HS256"

micronaut {
  security {
    token {
      jwt {
        signatures {
          secret {
            generator {
              secret = "${JWT_GENERATOR_SECRET}"
              jwsAlgorithm = "HS256"
            }
          }
        }
      }
    }
  }
}

{
  micronaut {
    security {
      token {
        jwt {
          signatures {
            secret {
              generator {
                secret = "${JWT_GENERATOR_SECRET}"
                jws-algorithm = "HS256"
              }
            }
          }
        }
      }
    }
  }
}

{
  "micronaut": {
    "security": {
      "token": {
        "jwt": {
          "signatures": {
            "secret": {
              "generator": {
                "secret": "${JWT_GENERATOR_SECRET}",
                "jws-algorithm": "HS256"
              }
            }
          }
        }
      }
    }
  }
}

If the injected value is Base64 encoded, keep using the existing base64 option.

micronaut.security.token.jwt.signatures.secret.generator.secret=${JWT_GENERATOR_SECRET_BASE64}
micronaut.security.token.jwt.signatures.secret.generator.base64=true
micronaut.security.token.jwt.signatures.secret.generator.jws-algorithm=HS256

micronaut:
  security:
    token:
      jwt:
        signatures:
          secret:
            generator:
              secret: ${JWT_GENERATOR_SECRET_BASE64}
              base64: true
              jws-algorithm: HS256

[micronaut]
  [micronaut.security]
    [micronaut.security.token]
      [micronaut.security.token.jwt]
        [micronaut.security.token.jwt.signatures]
          [micronaut.security.token.jwt.signatures.secret]
            [micronaut.security.token.jwt.signatures.secret.generator]
              secret="${JWT_GENERATOR_SECRET_BASE64}"
              base64=true
              jws-algorithm="HS256"

micronaut {
  security {
    token {
      jwt {
        signatures {
          secret {
            generator {
              secret = "${JWT_GENERATOR_SECRET_BASE64}"
              base64 = true
              jwsAlgorithm = "HS256"
            }
          }
        }
      }
    }
  }
}

{
  micronaut {
    security {
      token {
        jwt {
          signatures {
            secret {
              generator {
                secret = "${JWT_GENERATOR_SECRET_BASE64}"
                base64 = true
                jws-algorithm = "HS256"
              }
            }
          }
        }
      }
    }
  }
}

{
  "micronaut": {
    "security": {
      "token": {
        "jwt": {
          "signatures": {
            "secret": {
              "generator": {
                "secret": "${JWT_GENERATOR_SECRET_BASE64}",
                "base64": true,
                "jws-algorithm": "HS256"
              }
            }
          }
        }
      }
    }
  }
}

Operational Boundaries

Treat the 1Password Connect token as infrastructure credential material. Store and rotate it with the same controls you use for other deployment credentials, and grant only the vault, item, and field access required by the application.

Missing or invalid injected values fail like any other missing or invalid Micronaut configuration value. Micronaut Security does not add a retry loop, local cache, or fallback secret source for this docs-only integration. Caching, offline availability, synchronization, and token renewal belong to the selected 1Password deployment component.

For AOT and native-image deployments, provide secrets at runtime. Do not bake secret values into generated documentation, build outputs, AOT resources, container image layers, or native-image build arguments.

To roll back, restore the previous deployment secret source or change the environment variables referenced by the Micronaut configuration. No Micronaut Security code or dependency changes are required.

<< 8Endpoints

10Reactive Authentication Providers >>