Module spring.data.mongodb
Package org.springframework.data.mongodb.core.mapping

Annotation Interface Encrypted

@Documented @Retention(RUNTIME) @Target({TYPE,FIELD}) public @interface Encrypted
Encrypted provides data required for MongoDB Client Side Field Level Encryption that is applied during schema resolution. It can be applied on top level (typically those types annotated with Document to provide the encryptMetadata. 
 @Document
 @Encrypted(keyId = "4fPYFM9qSgyRAjgQ2u+IMQ==")
 public class Patient {
         private ObjectId id;
         private String name;

         @Field("publisher_ac")
         @DocumentReference(lookup = "{ 'acronym' : ?#{#target} }") private Publisher publisher;
 }

 "encryptMetadata": {
    "keyId": [
      {
        "$binary": {
          "base64": "4fPYFM9qSgyRAjgQ2u+IMQ==",
          "subType": "04"
        }
      }
    ]
  }

On property level it is used for deriving field specific encrypt settings. 
 public class Patient {
         private ObjectId id;
         private String name;

         @Encrypted(keyId = "4fPYFM9qSgyRAjgQ2u+IMQ==", algorithm = "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic")
         private String ssn;
 }

 "ssn" : {
   "encrypt": {
      "keyId": [
        {
          "$binary": {
            "base64": "4fPYFM9qSgyRAjgQ2u+IMQ==",
            "subType": "04"
          }
        }
      ],
      "algorithm" : "AEAD_AES_256_CBC_HMAC_SHA_512-Deterministic",
      "bsonType" : "string"
    }
  }
Since:
3.3
Author:
Christoph Strobl

  • Optional Element Summary

    Optional Elements
    Modifier and Type
    Optional Element
    Description
    String
    algorithm
    Set the algorithm to use.
    String[]
    keyId
    Get the keyId to use.

  • Element Details

    • keyId

      String[] keyId
      Get the keyId to use. The value must resolve to either the UUID representation of the key or a base64 encoded value representing the UUID value.
      On ElementType.TYPE level the keyId() can be left empty if explicitly set for fields.
      On ElementType.FIELD level the keyId() can be left empty if inherited from encryptMetadata.
      Returns:
      the key id to use. May contain a parsable expression. In this case the #target variable will hold the target element name.
      Default:
      {}

    • algorithm

      String algorithm
      Set the algorithm to use.
      On ElementType.TYPE level the algorithm() can be left empty if explicitly set for fields.
      On ElementType.FIELD level the algorithm() can be left empty if inherited from encryptMetadata.
      Returns:
      the encryption algorithm.
      See Also:
      Default:
      ""