MongoDB-Based Persistence for Secrets

[unami82]

Overview

This proposal introduces MongoDB-based persistence for Secrets in Elsa Workflows 3, enabling secure, scalable, and provider-consistent storage of sensitive configuration data such as API keys, connection strings, tokens etc...

Currently, when using MongoDB as the primary persistence provider for workflows and runtime data, secrets management may require an alternative storage mechanism. This feature aims to provide a first-class MongoDB secrets store implementation, fully integrated with Elsa 3’s abstractions and extensibility model.

Prototype Implementation

I have already implemented a working prototype that provides a custom implementation of ISecretStore using the Elsa.Persistence.MongoDb extension.

The prototype:

• Integrates with Elsa’s MongoDB persistence configuration
• Stores secrets in a dedicated MongoDB collection
• Supports encrypted secret values
• Is fully compatible with Elsa’s secret resolution pipeline
• Works transparently with existing workflow execution

The implementation leverages the existing MongoDB infrastructure configured via:

builder.Services.AddElsa(elsa =>
{
    elsa.UseMongoDb(configuration.GetSection("Elsa:PersistenceConnectionString"));

    elsa.UseWorkflowManagement(management => management.UseMongoDb());
    elsa.UseWorkflowRuntime(runtime => { runtime.UseMongoDb(); });
    ...

    //using MongoDb as persistence engine for secrets
    elsa.UseSecrets()
       .UseSecretsManagement(management => { management.UseMongoDb(); })
       .UseSecretsApi()
       .UseSecretsScripting();

    ....
});