4.3 Secure Properties Tool, Encryption & Maven Project Packaging

4.3 Secure Properties Tool, Encryption & Maven Project Packaging

Enterprise security and compliance standards prohibit storing plain-text passwords, client secrets, API tokens, and private keys in application repositories or source control. Mule 4 addresses this with the Anypoint Secure Configuration Properties module and the Mule Secure Properties Tool.

Additionally, Mule 4 fundamentally overhauled project dependency management and build packaging by migrating from legacy .zip archives to structured Mule Application .jar archives powered by the Mule Maven Plugin.

---

1. Anypoint Secure Configuration Properties Module

The Secure Configuration Properties module allows developers to encrypt sensitive values at rest in YAML or .properties files. At application startup, the Mule runtime uses a master decryption key provided at runtime to decrypt the values into memory.

XML Configuration Declaration

To use secure properties, add the module dependency to pom.xml and declare the <secure-properties:config> element in global.xml:

<secure-properties:config name="Secure_Properties_Config" 
                          file="config-secure-${env}.yaml" 
                          key="${encryption.key}">
    <secure-properties:encrypt algorithm="AES" 
                               mode="CBC" 
                               encoding="UTF-8" 
                               useRandomIVs="true"/>
</secure-properties:config>

Configuration Attributes:

• name: The global configuration identifier.
• file: The location of the secure properties file in src/main/resources (e.g., config-secure-dev.yaml).
• key: The master decryption key. Must always reference a dynamic runtime property (${encryption.key} or ${mule.key}) rather than a hardcoded string.
• algorithm: Cryptographic algorithm. Defaults to AES. Options: AES, Blowfish, DES, DESede (Triple DES), RSA.
• mode: Cipher block mode. Defaults to CBC. Options: CBC, CFB, ECB, OFB.
• useRandomIVs: When set to true, generates a random Initialization Vector for each encryption operation (recommended for maximum security).

[!CAUTION] Never Hardcode the Encryption Key: Hardcoding the decryption key in XML (key="MySecretKey123") completely defeats the purpose of property encryption. Always pass the key dynamically via runtime VM arguments (-Dencryption.key=...) or secure properties in Runtime Manager.

2. Mule Secure Properties Tool (secure-properties-tool.jar)

MuleSoft provides a standalone command-line utility, secure-properties-tool.jar, to encrypt and decrypt strings or entire files.

+-----------------------------------------------------------------------------+
|                     SECURE PROPERTIES TOOL CLI SYNTAX                       |
|                                                                             |
|   java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \
|        <method>        <-- 'string' or 'file'                               |
|        <operation>     <-- 'encrypt' or 'decrypt'                           |
|        <algorithm>     <-- 'AES', 'Blowfish', 'DES', 'DESede', 'RSA'        |
|        <mode>          <-- 'CBC', 'CFB', 'ECB', 'OFB'                       |
|        <key>           <-- 16, 24, or 32 character encryption key           |
|        <value/file>    <-- String literal to encrypt OR input file path     |
|        [output_file]   <-- Target output file path (for file method)        |
+-----------------------------------------------------------------------------+

A. Encrypting a Single String

To encrypt a database password ("MyDatabasePass2026!") with AES-CBC using key "MySecretKey12345":

java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \
  string encrypt AES CBC MySecretKey12345 "MyDatabasePass2026!"

Output:

0qKz8B7z61Nl8XqQ8Y...==

B. Encrypted Value Notation in Property Files

In YAML or .properties files, encrypted values must be wrapped in the ![...] syntax:

# src/main/resources/config-secure-dev.yaml
database:
  host: "dev-db.internal.corp"           # Non-sensitive value (plain text)
  user: "db_user"
  password: "![0qKz8B7z61Nl8XqQ8Y...==]" # Encrypted value

salesforce:
  client_secret: "![w8Kj29VxL019mQ...==]"

C. Encrypting an Entire File

To encrypt all values inside a property file in bulk:

java -cp secure-properties-tool.jar com.mulesoft.tools.SecurePropertiesTool \
  file encrypt AES CBC MySecretKey12345 config-dev.yaml config-secure-dev.yaml

---

3. Accessing Encrypted Properties in Mule

To access properties managed by the Secure Configuration Properties module, prefix the property key with the secure:: namespace.

A. In Mule XML Attributes: ${secure::property.key}

<db:config name="Database_Config">
    <db:my-sql-connection host="${db.host}" 
                           port="${db.port}" 
                           user="${db.user}" 
                           password="${secure::database.password}"/>
</db:config>

<salesforce:sfdc-config name="Salesforce_Config">
    <salesforce:basic-connection username="${sfdc.username}" 
                                 password="${secure::sfdc.password}" 
                                 securityToken="${secure::sfdc.token}"/>
</salesforce:sfdc-config>

B. In DataWeave 2.0: p('secure::property.key')

%dw 2.0
output application/json
---
{
    clientSecret: p('secure::salesforce.client_secret'),
    apiKey: Mule::p('secure::api.master_key')
}

[!IMPORTANT] If you attempt to access an encrypted property using standard ${database.password} without the secure:: prefix, Mule will return the raw, encrypted ciphertext string (![0qKz8...]) rather than the decrypted plain-text value.

4. Mule Maven Plugin & pom.xml Architecture

Mule 4 applications are standard Maven projects. The build lifecycle, dependency resolution, testing (MUnit), and deployment are controlled by the Project Object Model (pom.xml) and the mule-maven-plugin.

<?xml version="1.0" encoding="UTF-8"?>
<project xmlns="http://maven.apache.org/POM/4.0.0"
         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
    <modelVersion>4.0.0</modelVersion>

    <groupId>com.company.integration</groupId>
    <artifactId>orders-system-api</artifactId>
    <version>1.0.0</version>
    <!-- 1. Mandatory Packaging Type for Mule 4 -->
    <packaging>mule-application</packaging>

    <properties>
        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
        <app.runtime>4.4.0</app.runtime>
        <mule.maven.plugin.version>3.8.2</mule.maven.plugin.version>
    </properties>

    <build>
        <plugins>
            <!-- 2. Mule Maven Plugin Configuration -->
            <plugin>
                <groupId>org.mule.tools.maven</groupId>
                <artifactId>mule-maven-plugin</artifactId>
                <version>${mule.maven.plugin.version}</version>
                <extensions>true</extensions>
                <configuration>
                    <!-- Shared Libraries Configuration for External JDBC Drivers -->
                    <sharedLibraries>
                        <sharedLibrary>
                            <groupId>mysql</groupId>
                            <artifactId>mysql-connector-java</artifactId>
                        </sharedLibrary>
                    </sharedLibraries>
                    
                    <!-- CloudHub Deployment Plugin Configuration -->
                    <cloudHubDeployment>
                        <uri>https://anypoint.mulesoft.com</uri>
                        <muleVersion>${app.runtime}</muleVersion>
                        <username>${anypoint.username}</username>
                        <password>${anypoint.password}</password>
                        <applicationName>orders-sys-api-prod</applicationName>
                        <environment>Production</environment>
                        <workerType>MICRO</workerType>
                        <workers>1</workers>
                        <properties>
                            <env>prod</env>
                            <anypoint.platform.analytics_base_uri>https://analytics-ingest.anypoint.mulesoft.com</anypoint.platform.analytics_base_uri>
                        </properties>
                    </cloudHubDeployment>
                </configuration>
            </plugin>
        </plugins>
    </build>

    <dependencies>
        <!-- Mule Extension Dependencies -->
        <dependency>
            <groupId>org.mule.connectors</groupId>
            <artifactId>mule-http-connector</artifactId>
            <version>1.7.3</version>
            <classifier>mule-plugin</classifier>
        </dependency>
        <dependency>
            <groupId>org.mule.connectors</groupId>
            <artifactId>mule-db-connector</artifactId>
            <version>1.14.0</version>
            <classifier>mule-plugin</classifier>
        </dependency>
        <!-- Third-Party Shared Library Dependency (MySQL JDBC Driver) -->
        <dependency>
            <groupId>mysql</groupId>
            <artifactId>mysql-connector-java</artifactId>
            <version>8.0.30</version>
        </dependency>
    </dependencies>
</project>

Key pom.xml Elements Tested on the Exam:

1. <packaging>mule-application</packaging>: Instructs Maven to package the project using the Mule 4 application packaging structure.
2. <classifier>mule-plugin</classifier>: Identifies connector dependencies as Mule extensions that plug into the runtime's classloader isolation model.
3. <sharedLibraries>: In Mule 4, classloader isolation prevents connectors from seeing arbitrary project dependencies. For third-party Java libraries (such as database JDBC drivers: MySQL, Oracle, PostgreSQL), you must explicitly declare the library under <sharedLibraries> in the mule-maven-plugin configuration so the Database connector can load the driver class.

---

5. Mule 4 Deployable JAR Archive Anatomy

Building a Mule 4 project (mvn clean package) produces a deployable JAR archive (e.g., orders-system-api-1.0.0-mule-application.jar).

orders-system-api.jar
├── META-INF/
│   ├── maven/.../pom.xml
│   └── mule-artifact/
│       └── mule-artifact.json       # Application deployment descriptor
├── repository/                      # Embedded dependency repository
│   └── org/mule/connectors/...
├── api/                             # API specifications (RAML / OAS)
├── config-dev.yaml                  # Configuration property files
├── config-secure-dev.yaml
└── *.xml                            # Application flows (global.xml, interface.xml, impl.xml)

The mule-artifact.json Descriptor

Generated automatically during compilation, mule-artifact.json dictates the application's runtime boundaries:

• minMuleVersion: Minimum compatible runtime engine version.
• classLoaderModelLoaderDescriptor: Defines classloading isolation.
• secureProperties: Declares property keys that should be masked/hidden from the Anypoint Runtime Manager UI.