Github user aledsage commented on the issue:
https://github.com/apache/brooklyn-server/pull/918
Thanks @sjcorbett - LGTM.
For the record, I tested this in karaf with a toy catalog.bom:
```
brooklyn.catalog:
id: pr918
bundle: pr918
version: 1.0.0-SNAPSHOT
itemType: entity
brooklyn.libraries:
- url: .../brooklyn-etcd-2.7.0-20171219.1516.jar
auth:
username: $brooklyn:external("myexternals", "username")
password: $brooklyn:external("myexternals", "password")
item:
type: io.brooklyn.entity.nosql.etcd.EtcdNode
```
I break-pointed in Brooklyn to check what it was doing. By the time we get
into `CatalogItemDtoAbstract.parseLibraries`, looking up the `auth` map, the
DSL has already been resolved into the strings pointed at by the
username/password. This was earlier than I expected but it's fine.
I checked that the credentials are not persisted
(`BasicManagedBundleMemento` doesn't mention credentials, so they won't be).
I check the debug log, searching for my password - it was never logged.
---
