Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Drop VaultToken on infrastructure errors during renewal.

Browse Source 
We now drop the VaultToken if an infrastructure error (connection refused/connection timeout/read timeout/…) occurs. Dropping the token prevents usage of an expired token.

Closes gh-222.
This commit is contained in:
Mark Paluch
2018-03-20 11:45:17 +01:00
parent 056f73f0f4
commit 02ddcd1f69
2 changed files with 36 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java
View File

@@ -37,7 +37,6 @@ import org.springframework.vault.client.VaultResponses;
import org.springframework.vault.support.VaultResponse;
import org.springframework.vault.support.VaultToken;
import org.springframework.web.client.HttpStatusCodeException;
import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestOperations;
/**
@@ -195,18 +194,26 @@ public class LifecycleAwareSessionManager implements SessionManager, DisposableB
}
catch (HttpStatusCodeException e) {
logger.debug(String.format(
"Cannot renew token, resetting token and performing re-login: %s",
VaultResponses.getError(e.getResponseBodyAsString())));
this.token = null;
if (e.getStatusCode().is4xxClientError()) {
logger.debug(String
.format("Cannot refresh token, resetting token and performing re-login: %s",
VaultResponses.getError(e.getResponseBodyAsString())));
this.token = null;
return false;
}
throw new VaultException(VaultResponses.getError(e.getResponseBodyAsString()));
throw new VaultException(String.format("Cannot renew token: %s",
VaultResponses.getError(e.getResponseBodyAsString())));
}
catch (RestClientException e) {
throw new VaultException("Cannot refresh token", e);
catch (RuntimeException e) {
logger.debug(String.format(
"Cannot renew token, resetting token and performing re-login: %s",
e.toString()));
this.token = null;
throw new VaultException("Cannot renew token", e);
}
}

21
spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerUnitTests.java
View File

@@ -37,6 +37,7 @@ import org.springframework.vault.client.VaultHttpHeaders;
import org.springframework.vault.support.VaultResponse;
import org.springframework.vault.support.VaultToken;
import org.springframework.web.client.HttpServerErrorException;
import org.springframework.web.client.ResourceAccessException;
import org.springframework.web.client.RestOperations;
import static org.assertj.core.api.Assertions.assertThat;
@@ -211,6 +212,26 @@ public class LifecycleAwareSessionManagerUnitTests {
verify(clientAuthentication, times(2)).login();
}
@Test
public void shouldReLoginIfRenewalFails() {
when(clientAuthentication.login()).thenReturn(
LoginToken.renewable("login".toCharArray(), 5),
LoginToken.renewable("bar".toCharArray(), 5));
when(restOperations.postForObject(anyString(), any(), eq(VaultResponse.class)))
.thenThrow(new ResourceAccessException("Connection refused"));
ArgumentCaptor<Runnable> runnableCaptor = ArgumentCaptor.forClass(Runnable.class);
sessionManager.getSessionToken();
verify(taskScheduler).schedule(runnableCaptor.capture(), any(Trigger.class));
runnableCaptor.getValue().run();
assertThat(sessionManager.getSessionToken()).isEqualTo(
LoginToken.renewable("bar".toCharArray(), 5));
verify(clientAuthentication, times(2)).login();
}
@Test
public void shouldUseTaskScheduler() {