Uptake of SecretText

src/System Application/App/AI/src/Azure OpenAI/AzureOpenAIImpl.Codeunit.al

@@ -465,7 +465,7 @@ codeunit 7772 "Azure OpenAI Impl"
     var
         AzureKeyVault: Codeunit "Azure Key Vault";
         EnvironmentInformation: Codeunit "Environment Information";
-        KVSecret: Text;
+        KVSecret: SecretText;
     begin
         if not EnvironmentInformation.IsSaaSInfrastructure() then
             exit;

src/System Application/App/Azure Function/AzureFunctionsAuthentication.Codeunit.al

@@ -26,7 +26,7 @@
     /// <param name="ResourceURL">The Application ID URI</param>
     /// <returns>Instance of Azure function response object.</returns>
     [NonDebuggable]
-    procedure CreateOAuth2(Endpoint: Text; AuthenticationCode: Text; ClientId: Text; ClientSecret: Text; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text): Interface "Azure Functions Authentication"
+    procedure CreateOAuth2(Endpoint: Text; AuthenticationCode: Text; ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text): Interface "Azure Functions Authentication"
     var
         AzureFunctionsOAuth2: Codeunit "Azure Functions OAuth2";
     begin

src/System Application/App/Azure Function/AzureFunctionsOAuth2.Codeunit.al

@@ -19,7 +19,10 @@ codeunit 7802 "Azure Functions OAuth2" implements "Azure Functions Authenticatio
         [NonDebuggable]
         AuthenticationCodeGlobal, EndpointGlobal : Text;
         [NonDebuggable]
-        ClientIdGlobal, ClientSecretGlobal, OAuthAuthorityUrlGlobal, RedirectURLGlobal, ResourceURLGlobal, AccessToken : Text;
+        ClientIdGlobal, OAuthAuthorityUrlGlobal, RedirectURLGlobal, ResourceURLGlobal : Text;
+        ClientSecretGlobal: SecretText;
+        AccessToken: SecretText;
+        BearerLbl: Label 'Bearer %1', Comment = '%1 is the access token', Locked = true;
         FailedToGetTokenErr: Label 'Authorization failed to Azure function: %1', Locked = true;
         AzureFunctionCategoryLbl: Label 'Connect to Azure Functions', Locked = true;
 
@@ -37,7 +40,7 @@ codeunit 7802 "Azure Functions OAuth2" implements "Azure Functions Authenticatio
 
         OAuth2.AcquireTokenWithClientCredentials(ClientIdGlobal, ClientSecretGlobal, OAuthAuthorityUrlGlobal, RedirectURLGlobal, ResourceURLGlobal, AccessToken);
 
-        if AccessToken = '' then begin
+        if AccessToken.IsEmpty() then begin
             UriBuilder.GetUri(Uri);
             Dimensions.Add('FunctionHost', Format(Uri.GetHost()));
             FeatureTelemetry.LogError('0000I75', AzureFunctionCategoryLbl, 'Acquiring token', StrSubstNo(FailedToGetTokenErr, Uri.GetHost()), '', Dimensions);
@@ -46,7 +49,7 @@ codeunit 7802 "Azure Functions OAuth2" implements "Azure Functions Authenticatio
 
         RequestMessage.GetHeaders(Headers);
         Headers.Remove('Authorization');
-        Headers.Add('Authorization', 'Bearer ' + AccessToken);
+        Headers.Add('Authorization', SecretStrSubstNo(BearerLbl, AccessToken));
 
 
         if AuthenticationCodeGlobal <> '' then
@@ -58,7 +61,7 @@ codeunit 7802 "Azure Functions OAuth2" implements "Azure Functions Authenticatio
     end;
 
     [NonDebuggable]
-    procedure SetAuthParameters(Endpoint: Text; AuthenticationCode: Text; ClientId: Text; ClientSecret: Text; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text)
+    procedure SetAuthParameters(Endpoint: Text; AuthenticationCode: Text; ClientId: Text; ClientSecret: SecretText; OAuthAuthorityUrl: Text; RedirectURL: Text; ResourceURL: Text)
     begin
         EndpointGlobal := Endpoint;
         AuthenticationCodeGlobal := AuthenticationCode;

src/System Application/App/Azure Key Vault/src/AzureKeyVaultImpl.Codeunit.al

@@ -123,6 +123,7 @@ codeunit 2202 "Azure Key Vault Impl."
         X509Certificate2: Codeunit X509Certificate2;
         EnvironmentInformation: Codeunit "Environment Information";
         CertificateThumbprint: Text;
+        EmptySecretText: SecretText;
     begin
         if CachedCertificatesDictionary.ContainsKey(CertificateName) then begin
             Certificate := CachedCertificatesDictionary.Get(CertificateName);
@@ -136,7 +137,7 @@ codeunit 2202 "Azure Key Vault Impl."
         end;
         Certificate := NavAzureKeyVaultClient.GetAzureKeyVaultCertificate(CertificateName);
         if EnvironmentInformation.IsSaaS() then begin
-            X509Certificate2.GetCertificateThumbprint(Certificate, '', CertificateThumbprint);
+            X509Certificate2.GetCertificateThumbprint(Certificate, EmptySecretText, CertificateThumbprint);
             if CertificateThumbprint <> '' then
                 Session.LogMessage('0000C17', StrSubstNo(CertificateInfoTxt, CertificateName, CertificateThumbprint), Verbosity::Normal, DataClassification::SystemMetadata, TelemetryScope::ExtensionPublisher, 'Category', AzureKeyVaultTxt);
         end;

src/System Application/App/Azure Storage Services Authorization/src/AuthFormatHelper.Codeunit.al

@@ -42,7 +42,7 @@ codeunit 9060 "Auth. Format Helper"
     end;
 
     [NonDebuggable]
-    procedure GetAccessKeyHashCode(StringToSign: Text; AccessKey: Text): Text;
+    procedure GetAccessKeyHashCode(StringToSign: Text; AccessKey: SecretText): Text;
     var
         CryptographyManagement: Codeunit "Cryptography Management";
         HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512;

src/System Application/App/Azure Storage Services Authorization/src/SAS/StorServAuthSAS.Codeunit.al

@@ -46,7 +46,7 @@ codeunit 9061 "Stor. Serv. Auth. SAS" implements "Storage Service Authorization"
     end;
 
     [NonDebuggable]
-    procedure SetSigningKey(NewSigningKey: Text)
+    procedure SetSigningKey(NewSigningKey: SecretText)
     begin
         SigningKey := NewSigningKey;
     end;
@@ -241,8 +241,7 @@ codeunit 9061 "Stor. Serv. Auth. SAS" implements "Storage Service Authorization"
         AuthFormatHelper: Codeunit "Auth. Format Helper";
         [NonDebuggable]
         StorageAccountName: Text;
-        [NonDebuggable]
-        SigningKey: Text;
+        SigningKey: SecretText;
         SignedEncryptionScope: Text;
         StartDate: DateTime;
         EndDate: DateTime;

src/System Application/App/Azure Storage Services Authorization/src/SharedKey/StorServAuthSharedKey.Codeunit.al

@@ -29,7 +29,7 @@ codeunit 9064 "Stor. Serv. Auth. Shared Key" implements "Storage Service Authori
     end;
 
     [NonDebuggable]
-    procedure SetSharedKey(SharedKey: Text)
+    procedure SetSharedKey(SharedKey: SecretText)
     begin
         Secret := SharedKey;
     end;
@@ -47,7 +47,7 @@ codeunit 9064 "Stor. Serv. Auth. Shared Key" implements "Storage Service Authori
         SignaturePlaceHolderLbl: Label 'SharedKey %1:%2', Comment = '%1 = Account Name; %2 = Calculated Signature', Locked = true;
         SecretCanNotBeEmptyErr: Label 'Secret (Access Key) must be provided';
     begin
-        if Secret = '' then
+        if Secret.IsEmpty() then
             Error(SecretCanNotBeEmptyErr);
 
         StringToSign := CreateSharedKeyStringToSign(HttpRequestMessage, StorageAccount);
@@ -209,6 +209,5 @@ codeunit 9064 "Stor. Serv. Auth. Shared Key" implements "Storage Service Authori
     var
         AuthFormatHelper: Codeunit "Auth. Format Helper";
         ApiVersion: Enum "Storage Service API Version";
-        [NonDebuggable]
-        Secret: Text;
+        Secret: SecretText;
 }

src/System Application/App/Azure Storage Services Authorization/src/StorServAuthImpl.Codeunit.al

@@ -12,7 +12,7 @@ codeunit 9063 "Stor. Serv. Auth. Impl."
     InherentPermissions = X;
 
     [NonDebuggable]
-    procedure CreateSAS(SigningKey: Text; SignedVersion: Enum "Storage Service API Version"; SignedServices: List of [Enum "SAS Service Type"]; SignedResources: List of [Enum "SAS Resource Type"]; SignedPermissions: List of [Enum "SAS Permission"]; SignedExpiry: DateTime): Interface "Storage Service Authorization"
+    procedure CreateSAS(SigningKey: SecretText; SignedVersion: Enum "Storage Service API Version"; SignedServices: List of [Enum "SAS Service Type"]; SignedResources: List of [Enum "SAS Resource Type"]; SignedPermissions: List of [Enum "SAS Permission"]; SignedExpiry: DateTime): Interface "Storage Service Authorization"
     var
         OptionalParams: Record "SAS Parameters";
     begin
@@ -21,7 +21,7 @@ codeunit 9063 "Stor. Serv. Auth. Impl."
     end;
 
     [NonDebuggable]
-    procedure CreateSAS(SigningKey: Text; SignedVersion: Enum "Storage Service API Version"; SignedServices: List of [Enum "SAS Service Type"]; SignedResources: List of [Enum "SAS Resource Type"]; SignedPermissions: List of [Enum "SAS Permission"]; SignedExpiry: DateTime; OptionalParams: Record "SAS Parameters"): Interface "Storage Service Authorization"
+    procedure CreateSAS(SigningKey: SecretText; SignedVersion: Enum "Storage Service API Version"; SignedServices: List of [Enum "SAS Service Type"]; SignedResources: List of [Enum "SAS Resource Type"]; SignedPermissions: List of [Enum "SAS Permission"]; SignedExpiry: DateTime; OptionalParams: Record "SAS Parameters"): Interface "Storage Service Authorization"
     var
         StorServAuthSAS: Codeunit "Stor. Serv. Auth. SAS";
     begin
@@ -42,7 +42,7 @@ codeunit 9063 "Stor. Serv. Auth. Impl."
     end;
 
     [NonDebuggable]
-    procedure SharedKey(SharedKeyToUse: Text; ApiVersion: Enum "Storage Service API Version"): Interface "Storage Service Authorization"
+    procedure SharedKey(SharedKeyToUse: SecretText; ApiVersion: Enum "Storage Service API Version"): Interface "Storage Service Authorization"
     var
         StorServAuthSharedKey: Codeunit "Stor. Serv. Auth. Shared Key";
     begin

src/System Application/App/Azure Storage Services Authorization/src/StorageServiceAuthorization.Codeunit.al

@@ -62,7 +62,7 @@
     /// <param name="SharedKey">The shared key to use.</param>
     /// <returns>A Shared Key authorization.</returns>
     [NonDebuggable]
-    procedure CreateSharedKey(SharedKey: Text): Interface "Storage Service Authorization"
+    procedure CreateSharedKey(SharedKey: SecretText): Interface "Storage Service Authorization"
     var
         StorServAuthImpl: Codeunit "Stor. Serv. Auth. Impl.";
     begin
@@ -77,7 +77,7 @@
     /// <param name="ApiVersion">The API version to use.</param>
     /// <returns>A Shared Key authorization.</returns>
     [NonDebuggable]
-    procedure CreateSharedKey(SharedKey: Text; ApiVersion: Enum "Storage Service API Version"): Interface "Storage Service Authorization"
+    procedure CreateSharedKey(SharedKey: SecretText; ApiVersion: Enum "Storage Service API Version"): Interface "Storage Service Authorization"
     var
         StorServAuthImpl: Codeunit "Stor. Serv. Auth. Impl.";
     begin

src/System Application/App/Cryptography Management/src/CertificateRequest.Codeunit.al

@@ -23,11 +23,23 @@ codeunit 1463 CertificateRequest
     /// <param name="KeySize">The size of the key in bits.</param>
     /// <param name="IncludePrivateParameters">True to include a public and private RSA key in KeyAsXmlString. False to include only the public key.</param>
     /// <param name="KeyAsXmlString">Returns an XML string that contains the key of the RSA object that was created.</param>
+    [NonDebuggable]
     procedure InitializeRSA(KeySize: Integer; IncludePrivateParameters: Boolean; var KeyAsXmlString: Text)
     begin
         CertSigningRequestImpl.InitializeRSA(KeySize, IncludePrivateParameters, KeyAsXmlString);
     end;
 
+    /// <summary>
+    /// Initializes a new instance of RSACryptoServiceProvider with the specified key size and returns the key as an XML string.
+    /// </summary>
+    /// <param name="KeySize">The size of the key in bits.</param>
+    /// <param name="IncludePrivateParameters">True to include a public and private RSA key in KeyAsXmlString. False to include only the public key.</param>
+    /// <param name="KeyAsXmlString">Returns an XML string that contains the key of the RSA object that was created.</param>
+    procedure InitializeRSA(KeySize: Integer; IncludePrivateParameters: Boolean; var KeyAsXmlString: SecretText)
+    begin
+        CertSigningRequestImpl.InitializeRSA(KeySize, IncludePrivateParameters, KeyAsXmlString);
+    end;
+
     /// <summary>
     /// Initializes a new instance of the CertificateRequest with the specified parameters and the initialized RSA key.
     /// </summary>

src/System Application/App/Cryptography Management/src/CertificateRequestImpl.Codeunit.al

@@ -22,13 +22,23 @@ codeunit 1464 "CertificateRequest Impl."
         EndCertReqTok: Label '-----END CERTIFICATE REQUEST-----', Locked = true;
         DepricatedHashAlgorithmsMsg: Label 'In compliance with the Microsoft Secure Hash Algorithm deprecation policy SHA1 and MD5 hash alghoritms have been deprecated.';
 
+    [NonDebuggable]
     procedure InitializeRSA(KeySize: Integer; IncludePrivateParameters: Boolean; var KeyAsXmlString: Text)
     begin
         DotNetRSACryptoServiceProvider := DotNetRSACryptoServiceProvider.RSACryptoServiceProvider(KeySize);
         DotNetRSACryptoServiceProvider.PersistKeyInCsp(false);
         KeyAsXmlString := DotNetRSACryptoServiceProvider.ToXmlString(IncludePrivateParameters);
     end;
 
+    procedure InitializeRSA(KeySize: Integer; IncludePrivateParameters: Boolean; var KeyAsXmlString: SecretText)
+    var
+        [NonDebuggable]
+        KeyAsXml: Text;
+    begin
+        InitializeRSA(KeySize, IncludePrivateParameters, KeyAsXml);
+        KeyAsXmlString := KeyAsXml;
+    end;
+
     procedure InitializeCertificateRequestUsingRSA(SubjectName: Text; HashAlgorithm: Enum "Hash Algorithm"; RSASignaturePaddingMode: Enum "RSA Signature Padding")
     var
         DotNetHashAlgorithmName: DotNet HashAlgorithmName;

src/System Application/App/Cryptography Management/src/CryptographyManagement.Codeunit.al

@@ -123,7 +123,7 @@
     /// <param name="Key">Key to use in the hash algorithm.</param>
     /// <param name="HashAlgorithmType">The available hash algorithms include HMACMD5, HMACSHA1, HMACSHA256, HMACSHA384, and HMACSHA512.</param>
     /// <returns>Hashed value.</returns>
-    procedure GenerateHash(InputString: Text; "Key": Text; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
+    procedure GenerateHash(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
     begin
         exit(CryptographyManagementImpl.GenerateHash(InputString, Key, HashAlgorithmType));
     end;
@@ -157,7 +157,7 @@
     /// <param name="Key">Key to use in the hash algorithm.</param>
     /// <param name="HashAlgorithmType">The available hash algorithms include HMACMD5, HMACSHA1, HMACSHA256, HMACSHA384, and HMACSHA512.</param>
     /// <returns>Base64 hashed value.</returns>
-    procedure GenerateHashAsBase64String(InputString: Text; "Key": Text; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
+    procedure GenerateHashAsBase64String(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
     begin
         exit(CryptographyManagementImpl.GenerateHashAsBase64String(InputString, Key, HashAlgorithmType));
     end;
@@ -169,7 +169,7 @@
     /// <param name="Key">Key to use in the hash algorithm.</param>
     /// <param name="HashAlgorithmType">The available hash algorithms include HMACMD5, HMACSHA1, HMACSHA256, HMACSHA384, and HMACSHA512.</param>
     /// <returns>Base64 hashed value.</returns>
-    procedure GenerateBase64KeyedHashAsBase64String(InputString: Text; "Key": Text; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
+    procedure GenerateBase64KeyedHashAsBase64String(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
     begin
         exit(CryptographyManagementImpl.GenerateBase64KeyedHashAsBase64String(InputString, Key, HashAlgorithmType));
     end;
@@ -181,7 +181,7 @@
     /// <param name="Key">Key to use in the hash algorithm.</param>
     /// <param name="HashAlgorithmType">The available hash algorithms include HMACMD5, HMACSHA1, HMACSHA256, HMACSHA384, and HMACSHA512.</param>
     /// <returns>Hashed value.</returns>
-    procedure GenerateBase64KeyedHash(InputString: Text; "Key": Text; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
+    procedure GenerateBase64KeyedHash(InputString: Text; "Key": SecretText; HashAlgorithmType: Option HMACMD5,HMACSHA1,HMACSHA256,HMACSHA384,HMACSHA512): Text
     begin
         exit(CryptographyManagementImpl.GenerateBase64KeyedHash(InputString, Key, HashAlgorithmType));
     end;
@@ -205,7 +205,7 @@
     /// <param name="XmlString">The private key to use in the hash algorithm.</param>
     /// <param name="HashAlgorithm">The available hash algorithms are MD5, SHA1, SHA256, SHA384, and SHA512.</param>
     /// <param name="SignatureOutStream">The stream to write the signature for the specified input data.</param>
-    procedure SignData(DataInStream: InStream; XmlString: Text; HashAlgorithm: Enum "Hash Algorithm"; SignatureOutStream: OutStream)
+    procedure SignData(DataInStream: InStream; XmlString: SecretText; HashAlgorithm: Enum "Hash Algorithm"; SignatureOutStream: OutStream)
     begin
         CryptographyManagementImpl.SignData(DataInStream, XmlString, HashAlgorithm, SignatureOutStream);
     end;
@@ -255,7 +255,7 @@
     /// <param name="HashAlgorithm">The available hash algorithms are MD5, SHA1, SHA256, SHA384, and SHA512.</param>
     /// <param name="SignatureInStream">The stream of signature.</param>
     /// <returns>True if the signature is valid; otherwise, false.</returns>
-    procedure VerifyData(DataInStream: InStream; XmlString: Text; HashAlgorithm: Enum "Hash Algorithm"; SignatureInStream: InStream): Boolean
+    procedure VerifyData(DataInStream: InStream; XmlString: SecretText; HashAlgorithm: Enum "Hash Algorithm"; SignatureInStream: InStream): Boolean
     begin
         exit(CryptographyManagementImpl.VerifyData(DataInStream, XmlString, HashAlgorithm, SignatureInStream));
     end;