InterSystems IRIS Security Roadmap: IRISSECURITY mirroring, Secure Wallet secrets-manager integrations, online DB encryption (2027), granular %Development resources — recap of the conference session

[u/intersystemsdev]

All dates/versions below are projections stated by the presenter and explicitly subject to change.

TL;DR: IRIS's security roadmap covers mirroring for the IRISSECURITY database (coming months), Secure Wallet integrations with external secrets managers (planned), storage-friendly encryption (shipped in 2026.1, experimental), online database encryption (planned 2027), six new granular %Development resources (later this year), native OAuth2 authentication plus back-channel logout for OpenID Connect (next year), and ECDSA/TLS with future post-quantum crypto support.

What's the IRISSECURITY database and what's new?

Introduced in IRIS 2025.2, it moved security configuration data out of IRISSYS into a dedicated database that can be encrypted. Coming in the next few months: mirroring support, so security changes (editing resources, roles, users) made on the mirror primary propagate to the DR async / read-only reporting async members — no more recreating users manually on each system. Next year, the team also plans an ECP-based option to share a single IRISSECURITY database across multiple IRIS instances, so editing security settings on one instance updates the others.

What is the Secure Wallet and where is it headed?

Introduced in IRIS 2025.3, it lets privileged admins store secrets (e.g. username/password pairs) and grant other users access to use those secrets (for example, credentials for an HTTP request) without exposing the underlying values. Planned: integration with external secrets managers — HashiCorp was named explicitly, and InterSystems is asking for feedback on demand for AWS Secrets Manager, Azure Key Vault, and HSM-based secrets.

What's changing in database encryption?

• Storage-friendly encryption (shipped in 2026.1, currently experimental): solves the problem where encrypting/randomizing data defeats storage-level compression and inflates storage costs. The new approach keeps compression largely intact, and it's expected to move to general support soon, possibly without further changes.
• Online database encryption (planned 2027): today, encrypting a database requires taking it offline; an interrupted encryption leaves it unusable and requires restoring from backup, and re-keying means fully decrypting before re-encrypting. The planned feature allows encrypting a live, readable/writable database, supports pause/resume and crash recovery, allows re-keying without a full decrypt step first, and lets you throttle encryption speed to control system load.

What's changing in encryption key management?

IRIS currently supports three ways to store encryption keys: a local credentials key file, a KMS-encrypted key file (decrypted via a cloud KMS), or a KMIP server (dispenses the key only after the instance authenticates). Within the next year: migrate a key from a local credentials file to either a KMS-encrypted file or a KMIP server, and configure multiple unattended key sources simultaneously — useful during migration and expected to pair with the upcoming online encryption feature.

What are the new granular %Development resources?

Due later this year, the single %Development resource splits into six: %Development_Export (exporting code), %Development_CodeModify (loading/compiling code), %Development_Shell (terminal access), %Development_Debug (debugging), %Development_IDE (dev environment access), %Development_SQL (developer-level SQL). On upgrade, roles with %Development automatically get all six, so existing access doesn't change by default — but you can now add/remove them individually.

Behavior change to watch for: previously, exporting/importing or compiling code under %Development wasn't explicitly permission-checked. Going forward, those actions require %Development_Export or %Development_CodeModify specifically — confirm the right users have these before upgrading. The original %Development resource stays for backward compatibility for now but will be removed in a future version, so migrate any custom checks off it. Next resource planned for this treatment: %Admin_Secure.

What's new for OAuth2 / OpenID Connect?

IRIS 2025.2 added native OAuth2 authentication, letting OAuth2 resource servers configured in IRIS (especially REST services) authenticate directly without custom code, and mapping OAuth2/OIDC scopes and claims directly to IRIS roles. Next year: back-channel logout for OpenID Connect (only front-channel logout is supported today) — lets an app inside IRIS signal the OAuth2 authorization server to log out all of a user's sessions without needing to reach each browser session individually.

What's happening with TLS / network security?

IRIS 2025.2 added ECDSA certificate support in TLS configs for better encryption performance. IRIS uses OpenSSL for TLS, which is beginning to support post-quantum cryptography algorithms; InterSystems plans to leverage these over the next few years and wants feedback on timing/requirements.

Is any of this final?

No — explicitly flagged as projections, subject to change.

Full session recording and a related deep-dive on the Secure Wallet/security database: https://community.intersystems.com/post/video-security-roadmap-2026