I'll search the SnapLogic documentation for this. Where this encryption scheme is documented The wording you quoted comes from SnapLogic's documentation on how account credentials are encrypted. It appears in two places: 1. Security overview (Standard Encryption). This page covers SnapLogic's Standard Encryption, which protects Account credentials. 2. Security - Credentials: Endpoint credentials. This page covers the same flow, and says it applies to credentials in Designer and Classic Manager (accounts) and in AutoSync (credentials). What the documentation says - Asymmetric encryption: Each organization (environment) has an asymmetric key pair that SnapLogic manages. - Encryption in the browser: When you enter sensitive properties such as passwords, the browser encrypts them with the organization's public key. - Transport: The encrypted data goes over HTTPS to the control plane. - Storage at rest: The control plane stores the encrypted account information in a secure S3 bucket that uses server-side encryption for data at rest. - Runtime: The Snaplex node retrieves the encrypted data and decrypts it with the organization's private key. It does not persist the credentials locally. What the documentation does not say These pages do not name a specific algorithm or key size. They don't mention RSA or AES-256 for the account-encryption scheme. They only say "asymmetric key pair" and "server-side encryption". If you need exact algorithm and key-size details, for example for a security questionnaire or compliance review, the public docs won't answer it. Ask SnapLogic Support or your account team, who can usually provide a security whitepaper or attestation. The only place the docs name algorithms is for pipeline-level encryption Snaps, which is a separate feature: - PGP Encrypt lists symmetric options such as AES_128/192/256, Twofish and Camellia. - Twofish Encrypt and the Symmetric Crypto account cover AES, Blowfish and Twofish. These apply to data you encrypt inside your own pipelines. They are not the platform's credential-encryption scheme. Stronger options For self-managed Snaplexes (Groundplexes), the docs describe two options: - Enhanced Encryption: The private key stays on your Groundplex nodes, so the control plane can't decrypt your credentials. - Secrets Management: Credentials live in a third-party secrets manager, and the SnapLogic account holds only what it needs to reach it. Neither protects against misuse by people inside your own organization. I can also point you to the docs for a specific encryption Snap, or help set up Enhanced Encryption or Secrets Management.
I'll look up how SnapLogic Secrets Management stores secrets for Cloudplexes and which encryption algorithm it uses. How SnapLogic Secrets Management Stores Secrets (Cloudplexes) Secrets Management is not available on Cloudplexes Secrets Management is available only for pipelines running on Groundplexes (self-managed Snaplexes). A SnapLogic-managed Cloudplex can't use it. Cloudplex pipelines use SnapLogic's standard account encryption instead, described below. How Secrets Management works (Groundplex) With Secrets Management, SnapLogic doesn't store your credentials. A third-party secrets manager holds them, and the supported options are: - AWS Secrets Manager - Azure Key Vault - CyberArk Conjur (Enterprise or Open Source) - HashiCorp Vault (Cloud, Enterprise, or Open Source) The SnapLogic account holds only the information needed to reach the secrets manager. The Groundplex node fetches the secret directly from the secrets manager during pipeline validation and execution. Neither the control plane nor the Snaplex nodes store the configured secrets. Optional Secrets Cache: If enabled (contact your CSM), the Groundplex node checks the cache first. If the secret isn't there, it retrieves it from the secrets manager, encrypts it, and caches it. The documentation doesn't name the encryption algorithm used for the cache, but your CSM can change the encryption key and the cache expiration time. What applies to Cloudplexes: Standard Encryption Account credentials for Cloudplexes are protected by SnapLogic's Standard Encryption: 1. Asymmetric key pair: Each organization (environment) has its own key pair, managed by SnapLogic. 2. Encryption in the browser: When you enter sensitive properties such as passwords, they are encrypted in the browser with your org's public key. 3. Transport: The encrypted data goes to the control plane over HTTPS. 4. Storage at rest: The control plane stores it in a secure S3 bucket with server-side encryption. 5. Use at runtime: The Snaplex node retrieves the encrypted data from the control plane and decrypts it with the org's private key. It doesn't persist the credentials locally. Credentials are never stored or sent over the wire unencrypted. What the documentation says about the algorithm - The documentation describes the scheme as asymmetric (public/private key pair) encryption, with server-side encryption for data at rest in S3. It doesn't name a specific algorithm or key size, such as RSA or AES-256. - TLS 1.2 is supported for secure connections. TLS 1.0 and 1.1 are not. - For the exact cryptographic algorithms, contact SnapLogic Support (support@snaplogic.com) or your CSM. Stronger options for self-managed Snaplexes | Option | Where credentials/keys live | |---|---| | Standard Encryption | SnapLogic manages the org key pair | | Enhanced Account Encryption | The private key stays on your Groundplex nodes, so the control plane can't decrypt credentials | | Secrets Management | Credentials stay in your third-party secrets manager | If you're on a Cloudplex and need a secrets manager, you would need Groundplex nodes. For secure connectivity from a Cloudplex to on-premises endpoints, SnapLogic offers Cloudplex Secure Connectivity. None of these options protect against misuse by people inside your organization, so make sure only authorized users can access credentials.
Collecting information for your query, please wait......
I'll look this up in the SnapLogic documentation. How SnapLogic Secrets Management Stores Secrets Short answer With Secrets Management, SnapLogic doesn't store the secrets at all. They stay in your third-party secrets manager. The SnapLogic account stores only the information needed to retrieve the secret. The documentation I found doesn't name an encryption algorithm for Secrets Management, so I can't state one. Where secrets are stored - Credentials live in a third-party secrets manager. Supported options are: - AWS Secrets Manager - Azure Key Vault - CyberArk Conjur (Enterprise or Open Source) - HashiCorp Vault (Cloud, Enterprise, or Open Source) - Endpoint accounts contain only the details needed to reach the secrets manager and fetch the secret, not the credentials themselves. - The SnapLogic control plane and Snaplex nodes never store the configured secrets. - Pipelines running on a Groundplex retrieve the secret directly from the secrets manager during validation and execution. Encryption and the optional Secrets Cache - Encryption of the stored secret is handled by the secrets manager you choose (for example, Vault or Key Vault), according to that product's own security model. - SnapLogic offers an optional Secrets Cache for pipelines that request the same secret many times. On each request, the Groundplex node checks the cache: - If the secret is found, it is returned. - If not, it is retrieved from the secrets manager, encrypted, and cached. - Your CSM can enable the cache, change the cache expiration time, or change the encryption key through feature flags. - The documentation doesn't say which algorithm the cache uses, so ask your CSM or SnapLogic Support. For comparison: standard account encryption (without Secrets Management) - Each environment (Org) has an asymmetric key pair managed by SnapLogic. - Sensitive fields, such as passwords, are encrypted in the browser with the Org's public key. - The encrypted data is sent over HTTPS to the control plane. It is stored in an S3 bucket with server-side encryption for data at rest. - At runtime, the Snaplex node retrieves the data, decrypts it with the Org's private key, and doesn't persist it locally. - With Enhanced Account Encryption, the private key stays on your Groundplex nodes, so the control plane cannot decrypt the credentials. - The docs describe this as an asymmetric key pair but don't name a specific algorithm (such as RSA key size). Limitations - Secrets Management works only with Groundplexes. - It works only for account credentials (passwords, tokens), not for SnapLogic authentication or node server keys. - It requires accounts with expression-enabled authentication fields. - Neither it nor standard encryption protects against misuse by people inside your organization, so restrict access to credentials. Next step For a specific cipher, key size, or cache encryption detail, for example for a security review, contact your SnapLogic CSM or support@snaplogic.com.
I'd like to cite documentation for you, but I don't see an earlier response in this thread to back up. This looks like the start of our conversation, and no pipeline or Snap is currently open or selected. To help me find the right documentation, could you tell me one of the following? - The topic or claim you'd like sources for (for example, a specific Snap, an expression function, scheduling a pipeline, or a task type). - The original question you asked, so I can look up the relevant SnapLogic documentation and share what it says. Once I know the subject, I'll search the SnapLogic knowledge sources and give you an answer with references.
Your request to "cite documentation" doesn't say which topic or feature you want documentation for. Could you tell me more about what you're looking for? For example: - A specific Snap, such as the documentation for the Mapper, Join, or REST Get Snap - A feature or concept, such as pipeline parameters, error handling, scheduling tasks, or Groundplex setup - Expression language syntax, such as functions for strings, dates, or arrays - A statement from an earlier answer that you want a source for Once I know the topic, I can look it up and point you to the relevant SnapLogic documentation. No pipeline is open and no Snap is selected right now, so I have nothing on the canvas to base this on. If you want documentation about something specific in a pipeline, open it first and tell me which part.
Dynamic Snowflake → S3 Extraction Approach This is a common pattern, and SnapLogic has good building blocks for it. Here's a solid architecture to handle dynamically growing tables/schemas without needing to hardcode or manually update pipelines every time something changes. Recommended Approach: Metadata-Driven Pipeline 1. Discover tables/schemas dynamically Instead of hardcoding table names, query Snowflake's metadata views at runtime: - Use a Snowflake Execute Snap to query INFORMATION_SCHEMA.TABLES (or SHOW TABLES IN SCHEMA ...) to get the current list of tables/schemas. - This becomes your "driver" list — anything new that shows up here gets picked up automatically on the next run. 2. Iterate over the discovered list - Feed the list of tables into a Pipeline Execute Snap (child pipeline pattern), passing each table/schema name as a pipeline parameter. - The child pipeline does the actual extraction logic (read from Snowflake table → write to S3), parameterized so it works for any table. 3. Child pipeline (generic extractor) - Use a Snowflake Select/Execute Snap with a dynamically built query (e.g., SELECT * FROM $schema.$table) using expressions. - Pass the output to a File Writer / S3 Snap, where the target S3 key/path is also built dynamically (e.g., s3://bucket/$schema/$table/$date.csv or .parquet). - This way, one child pipeline handles unlimited tables without modification. 4. Handle schema drift (new/changed columns) - Since you're reading dynamically, avoid strict schema mapping in a Mapper if possible — let the data pass through generically (JSON/CSV with headers) so new columns don't break anything. - If you need enforced structure, consider writing in a self-describing format like Parquet or JSON, which tolerates schema evolution better than fixed-width CSV. 5. Orchestration - Trigger the parent (discovery) pipeline on a schedule (Scheduled Task) or via an Ultra/Triggered Task depending on your latency needs. - Optionally maintain a control table (in Snowflake or a simple file) to track which tables have already been processed, last extraction timestamp, watermark columns, etc., for incremental loads. 6. Error handling & scalability - Use error pipelines/catch snaps so one failing table doesn't stop the whole batch. - Consider the Pipeline Execute Snap's "reuse count" and parallel execution settings to process multiple tables concurrently for performance. --- Summary of the Pattern
[Discover Schemas/Tables via INFORMATION_SCHEMA]
│
▼
[Pipeline Execute - loop per table] ──► [Generic Extractor Pipeline]
│
[Snowflake Select] → [S3 Writer]
This gives you a self-adjusting pipeline: new tables/schemas added in Snowflake are automatically picked up on the next scheduled run, with no manual pipeline changes required. --- Would you like me to actually generate this pipeline for you (the metadata discovery + dynamic extraction pattern), or are you looking for more guidance/design discussion first?
6. Recommended Overall Flow 1. Export current users/groups (CSV or API) for a full inventory and rollback reference. 2. Update allowlist to include the new domain. 3. Script the account updates using the public Users/Groups APIs, mapping old emails → new emails. 4. Reassign any orphaned asset ownership resulting from deletions. 5. Reconfigure SSO/MFA settings tied to the new domain, if applicable. 6. Validate via the Admin Manager Users screen (role, access, group counts, login type) and spot-check asset ownership on key projects/pipelines. 7. Communicate the cutover to downstream teams, especially if task URLs or notification configs reference user emails. If this activity is part of a larger environment migration (not just a domain rename), SnapLogic's full migration playbook and CSM/PS-assisted migration tool are typically used, since account re-encryption, trusted environment setup, and asset validation become more involved at that scale. Let me know if that's the case and I can go deeper into that playbook.
Managing Multiple User Accounts & Assets During a Mass Email Domain Migration When your organization changes its email domain (e.g., @oldcompany.com → @newcompany.com), you need to update every affected user account while making sure their owned assets (pipelines, accounts, tasks, projects) stay intact. Here's how to approach it: 1. Inventory Current Users and Their Assets From Admin Manager → Users, you can: - Download a CSV list of all users — this gives you emails, names, roles, group memberships, and access types, which is essential for planning a bulk update. - Filter/search by role or access type to scope exactly which accounts are affected by the domain change.
Important: In SnapLogic, every asset has an owner tied to a user account. This is why the migration/update of accounts must be carefully sequenced — you don't want to orphan ownership of pipelines, projects, or accounts.
2. Update Each Account's Email (Core of the Migration) For a handful of users, you can edit accounts manually in Admin Manager (click a row to edit details). For a mass migration, scripting against the public APIs is the recommended path: - Get a user (GET /api/1/rest/public/users/{email}) — retrieve current profile and org membership. - Create/Update a user (POST or PUT /api/1/rest/public/users) — note the API accepts fields like email, first_name, last_name, organization, administrator, allow_password_login, ui_access, etc. - Since emails are usually the unique identifier, a domain-wide email change often requires creating a new account record under the new email and transitioning ownership, since directly editing the primary email key may not be supported for all account types — plan to validate this per account type (user, team, service account). 3. Handle Asset Ownership Carefully - If you delete an old account during cleanup, note that ownership of all its assets automatically transfers to the Environment admin who performs the deletion — not to the new/replacement account. You'll likely need a follow-up step to reassign ownership to the correct new user. - For users and groups specifically, SnapLogic recommends this sequence (especially relevant if domain change coincides with environment/org changes): 1. Pull the full list of users and the groups they belong to (via CSV export or the Groups/Members APIs). 2. Re-create or update groups first. 3. Re-create or update user accounts and reassign group memberships. 4. Validate Allowlists and Access Policies - SnapLogic validates new users against an email domain allowlist during account creation. If the new domain isn't allowlisted, user creation will be blocked — update the allowlist before running your mass update/migration script. - If your org uses SSO or MFA, check whether login configurations also need to be updated to reflect the new domain (SSO credentials/certificates are not automatically migrated and require manual reconfiguration). 5. Bulk Operations Support - The Admin Manager UI supports multi-select actions: you can select multiple users and bulk-delete, modify application access, or update authentication methods (password/SSO/MFA) — useful for cleanup after the domain cutover, though direct bulk email-renaming via UI isn't a listed capability; scripting via the public APIs is the more scalable route for the actual domain swap.
I'll look this up for you. Setting Up a Salesforce JWT OAuth2 Account The JWT OAuth2 flow is a server-to-server authentication method — it eliminates interactive logins, which is ideal for backend integrations. Here's how to configure it: Prerequisites - A generated private key and certificate - Valid Issuer (Client ID), Subject (Username), and Audience (Server URL) Step-by-Step Setup Step 1: Generate the private key and certificate
bash
openssl req -newkey rsa:2048 -new -nodes -keyout key.pem -out csr.pem
openssl x509 -req -days 365 -in csr.pem -signkey key.pem -out server.crt
Step 2: Create a Connected App in Salesforce 1. Upload the certificate to the Connected App. 2. Click Manage on the newly created Connected App. 3. Under OAuth policies, set Permitted Users to All users may self-authorize. 4. Go to Manage Apps > Manage Profiles, select System administrator, and save. 5. This generates the Consumer Key and Consumer Secret — store these securely, as you'll need them for the account. Step 3: Create a .jks keystore file from the same certificate:
bash
openssl pkcs12 -export -in server.crt -inkey key.pem -out keystore.p12 -name myalias
keytool -importkeystore -deststorepass changeit -destkeypass changeit \
-destkeystore keystore.jks -srckeystore keystore.p12 \
-srcstoretype PKCS12 -srcstorepass user -alias myalias
Step 4: Configure the account in SnapLogic Designer | Field | What to Enter | |---|---| | Instance URL | Your Salesforce instance, e.g. https://na123.salesforce.com | | Issuer (Client ID) | The Consumer Key from your Connected App | | Subject (Username) | The Salesforce account username | | Audience (Server URL) | https://login.salesforce.com (production), https://test.salesforce.com (sandbox), or your custom domain | | Keystore | Upload the keystore.jks file (can come from SLDB or an unauthenticated https:// endpoint) | | Keystore password | Password for the keystore | | Key alias | The alias used when generating the keystore | | Private key passphrase | Only needed if it differs from the keystore password | Click Validate to confirm the account works. --- Do You Need Access to the Machine SnapLogic Runs On? No, not necessarily. The Keystore field explicitly supports uploading the .jks file from SLDB (SnapLogic's internal storage) or from any unauthenticated https:// endpoint. This means you don't need direct filesystem/machine access — you can host the keystore file somewhere accessible over HTTPS, or upload it directly into SLDB through the Designer/Manager, and reference it from there. Does This Work on a Cloudplex? Yes — since the keystore can be delivered via SLDB or an HTTPS endpoint rather than a local file path, this approach is fully compatible with a Cloudplex, where you don't have direct access to the underlying Snaplex nodes. You simply upload the keystore through the account configuration UI (using the Upload capability), and the account setup process works the same way as it would with any other plex type. --- Related setup: If you haven't yet created the Connected App structure itself in Salesforce (separate from the JWT-specific steps above), you may also want to review the general Salesforce Connected App configuration for OAuth2 accounts, which covers Callback URLs and scopes in more detail. Let me know if you'd like help troubleshooting a specific validation error or want guidance on referencing this account inside a Salesforce Snap pipeline.