The Luna HSM plugin supports the following types of credentials: 

Configuration Parameters

  • host: Luna appliance hostname or IP address (e.g. 10.11.55.12)
  • port: NTLS port, default 1792 (fixed)
  • slotIds: Optional list of unique numeric PKCS#11 partition slot IDs to scan (e.g. ["0", "1"], maximum 32). For new configurations, omit this field or use an empty list to discover all token-present slots automatically.
  • pin: Required shared partition PIN used for every selected or automatically discovered partition (write-only / masked).
  • serverCaCert: PEM-encoded Luna server CA certificate (required)
  • clientCert: PEM-encoded Luna client certificate (required)
  • clientKey: PEM-encoded Luna client private key, encrypted or unencrypted (required, write-only / masked)
  • includeSecrets: Include CKO_DATA objects whose CKA_APPLICATION, after trimming whitespace and converting to lowercase, is credential or secret (optional, default false); other application data is omitted

Partitions are scanned sequentially. Explicit slot IDs are used as requested; unavailable slots are reported as partition failures, not silently skipped. Automatic discovery uses C_GetSlotList(true). If more than 32 token-present slots are discovered, the operation fails rather than silently truncating the list; supply a smaller slotIds filter.

Legacy Configuration Compatibility

The backend still accepts slotId in saved configurations or JSON input, but it is not displayed in the configuration form. It accepts one numeric ID (e.g. "0") or comma-separated IDs (e.g. "0, 1"). A nonempty slotIds list takes precedence. Otherwise, a retained legacy slotId continues to restrict partition selection. To enable automatic discovery for an existing configuration, remove or clear its legacy slotId in JSON input and omit or empty slotIds; leaving only slotIds empty does not override a saved legacy filter.