tresor

One OIDC login, role-based secrets for DuckDB. tresor is a DuckDB extension that attaches your organisation's secrets service. You log in once through your identity provider — Keycloak, Okta, Entra ID, any OIDC provider — and the secrets your role may use appear in DuckDB's own secret manager: ATTACH … (SECRET crm_ro), FROM 's3://lake/…' and every other secret consumer just work.

ATTACH 'tresor:secrets.corp.example' AS corp;   -- browser login, once

FROM corp.secrets();                                   -- what your role may use
ATTACH '' AS crm (TYPE mssql, SECRET crm_ro);          -- a secret from the service
FROM 's3://lake/sales/*.parquet';                      -- found by scope, like any secret

Status

Everything on this site works today (in a browser, with DuckDB-wasm on 2.0 - see In a web application): attaching, the logins of people (from any client) and of services and pipelines, the secrets in DuckDB's lookup, writes and grants, variables, dynamic secrets, acting for duckdb-acl's sessions and the audit. Released: tresor 0.1.0, for DuckDB 2.0.0 (INSTALL tresor FROM community;), and the protocol is version 1.

What it is

• A client, not a vault. Where and how secrets are stored is the service's business. tresor speaks an open protocol — duckdb-secrets/1 — that a service in any language implements.
• The ATTACH is the whole setup. DuckDB loads an installed extension by the prefix of the path it is asked to attach, so ATTACH 'tresor:…' is the only statement a user writes: discovery, login and mounting happen inside it.
• Your role decides, the service enforces. You use what an administrator granted your roles — the same through the CLI as through a server acting for you, which serves you its own grants.
• Management is SQL, for administrators. CREATE PERSISTENT SECRET … IN corp stores into the service; grants and annotations are functions of the attached catalog.

Where to next

• Getting started — the first attach, for a person and for a service.
• In your application — tresor in a program that embeds DuckDB (Python, Go, Rust, Java; .NET and the browser as they reach 2.0), with the application's own login.
• From DuckDB UI, Python and IDEs and Pipelines — logging in where you run DuckDB.
• In a web application — DuckDB-wasm in a page, on the page's own login.
• Microsoft Entra ID — the app registrations and the service's issuer entry.
• Concepts — the attached catalog, lookup, persistence, acting for users.
• SQL reference — ATTACH options, the tresor secret, settings, functions, the audit.
• Protocol — the specification a secrets service implements.
• Reference server — the protocol in a small Go server, and the conformance suite; production: tresor-server.
• Security model — what a role can and cannot protect, and why delegation matters.