Request: Multiple instances of SecretStore about secretstore

[jdhitsolutions]

I might want one store with data that is associated with a module or CI/CD project I'm running and a second store for personal items. I might want one group of data to have a longer unlock time and another set to be more secure. A single store means every secret is treated the same and maybe that isn't what I want.

[SjoerdV]

Really need this as well. The use case is:

• I need to have one vault protected with a password, so it will protect personal credentials and stuff unless unlocked.
• I also need one vault unprotected because of a PnP.PowerShell recommendation. https://pnp.github.io/powershell/articles/credentialmanagement.html
• preferably I would operate a separate vault for different customers

[PaulHigin]

Sounds like there is a need for multiple store instances. Adding PS-Committee review for visibility.

/cc: @SteveL-MSFT, @SydneyhSmith

[PetriAsi]

I have same king of needs with @jdhitsolutions . Also custom or third party modules will benefit if secretstore can be register multiple times with different names and instances. Then custom module can create it's own store for it's secrets.

[craibuc]

I'd like to have multiple Microsoft.PowerShell.SecretStore SecretStores to segment secrets between clients.

[jdhitsolutions]

Clearly, there is some sort of interaction happening.

[PaulHigin]

SecretManagement allows an extension vault to be registered multiple times, because it is possible that an extension vault may support different contexts via the registration VaultParameters. However, the SecretStore vault currently always operates in the logged on user scope (see SecretStore documentation: https://github.com/powershell/secretstore).

So registering SecretStore multiple times with different names just results in duplication of the same store, and doesn't make sense.
But we decided to allow this for maximum flexibility.

[jdhitsolutions]

Ok then. Again, it would help to have this clearer in the documentation. The bottom line is that a user can only have 1 microsoft.powershell.secretstore vault per user scope. That's too bad because I can imagine a situation where I might want 2 stores based on the default Microsoft.PowerShell.SecretStore. Or are you expecting that people will really be using an extension vault like LastPass?

[SydneyhSmith]

Thanks @jdhitsolutions I'd love to better understand why a user may want multiple SecretStore instances in a particular user scope, does having secretmetadata help users to organize their secrets in a way that doesnt require a second instance of the store?

Agree that we can make this more clear in the SecretStore documentation

[craibuc]

Is there a way to create independent, Microsoft.PowerShell.SecretStore instances by supplying values to -VaultParameters?