Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing.

Browse Source 
Rename consistently role option. Add since and author tags.

Closes gh-780
This commit is contained in:
Mark Paluch
2023-04-19 08:27:18 +02:00
parent 1e8753eaca
commit 4f7f7e9021
7 changed files with 68 additions and 45 deletions
Download Patch File Download Diff File Expand all files Collapse all files

33
spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java
View File

@@ -15,13 +15,23 @@
*/
package org.springframework.vault.authentication;
import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.post;
import java.util.Collections;
import java.util.Map;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.Assert;
import org.springframework.vault.support.VaultResponse;
import org.springframework.vault.support.VaultToken;
import org.springframework.web.client.RestClientException;
import org.springframework.web.client.RestOperations;
import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.*;
import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;
import org.springframework.util.Assert;
import org.springframework.vault.support.VaultResponse;
import org.springframework.vault.support.VaultToken;
@@ -32,6 +42,7 @@ import org.springframework.web.client.RestOperations;
* TLS Client Certificate {@link ClientAuthentication}.
*
* @author Mark Paluch
* @author Andy Lintner
*/
public class ClientCertificateAuthentication implements ClientAuthentication, AuthenticationStepsFactory {
@@ -83,8 +94,7 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au
public static AuthenticationSteps createAuthenticationSteps(ClientCertificateAuthenticationOptions options) {
Assert.notNull(options, "ClientCertificateAuthenticationOptions must not be null");
String name = options.getName();
Map<String, String> body = name != null ? Collections.singletonMap("name", name) : Collections.emptyMap();
Map<String, Object> body = getRequestBody(options);
return AuthenticationSteps.fromSupplier(() -> body)
.login(post(AuthenticationUtil.getLoginPath(options.getPath())).as(VaultResponse.class));
@@ -103,12 +113,9 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au
private VaultToken createTokenUsingTlsCertAuthentication() {
try {
String name = this.options.getName();
VaultResponse response = this.restOperations.postForObject(
AuthenticationUtil.getLoginPath(this.options.getPath()),
name != null ? Collections.singletonMap("name", name) : Collections.emptyMap(),
VaultResponse.class);
Map<String, Object> request = getRequestBody(this.options);
VaultResponse response = this.restOperations
.postForObject(AuthenticationUtil.getLoginPath(this.options.getPath()), request, VaultResponse.class);
Assert.state(response.getAuth() != null, "Auth field must not be null");
@@ -121,4 +128,10 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au
}
}
private static Map<String, Object> getRequestBody(ClientCertificateAuthenticationOptions options) {
String name = options.getRole();
return name != null ? Collections.singletonMap("name", name) : Collections.emptyMap();
}
}

25
spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOptions.java
View File

@@ -26,6 +26,7 @@ import org.springframework.util.Assert;
* constructed.
*
* @author Mark Paluch
* @author Andy Lintner
* @since 2.3
* @see ClientCertificateAuthenticationOptions
* @see #builder()
@@ -40,14 +41,14 @@ public class ClientCertificateAuthenticationOptions {
private final String path;
/**
* Optional named certificate role to authenticate against.
* Named certificate role to authenticate against. Can be {@literal null}.
*/
@Nullable
private final String name;
private final String role;
private ClientCertificateAuthenticationOptions(String path, String name) {
private ClientCertificateAuthenticationOptions(String path, @Nullable String role) {
this.path = path;
this.name = name;
this.role = role;
}
/**
@@ -66,10 +67,11 @@ public class ClientCertificateAuthenticationOptions {
/**
* @return the optional named certificate role to authenticate against.
* @since 2.3.4
*/
@Nullable
public String getName() {
return this.name;
public String getRole() {
return this.role;
}
/**
@@ -80,7 +82,7 @@ public class ClientCertificateAuthenticationOptions {
private String path = DEFAULT_CERT_PATH;
@Nullable
private String name;
private String role;
ClientCertificateAuthenticationOptionsBuilder() {
}
@@ -102,12 +104,13 @@ public class ClientCertificateAuthenticationOptions {
* Configure the named certificate role to authenticate against.
* @param name must not be empty or {@literal null}.
* @return {@code this} {@link ClientCertificateAuthenticationOptionsBuilder}.
* @since 2.3.4
*/
public ClientCertificateAuthenticationOptionsBuilder name(String name) {
public ClientCertificateAuthenticationOptionsBuilder role(String name) {
Assert.hasText(name, "Name must not be empty");
Assert.hasText(name, "Role must not be empty");
this.name = name;
this.role = name;
return this;
}
@@ -116,7 +119,7 @@ public class ClientCertificateAuthenticationOptions {
* @return a new {@link ClientCertificateAuthenticationOptions}.
*/
public ClientCertificateAuthenticationOptions build() {
return new ClientCertificateAuthenticationOptions(this.path, this.name);
return new ClientCertificateAuthenticationOptions(this.path, this.role);
}
}

19
spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTestBase.java
View File

@@ -43,6 +43,7 @@ import org.springframework.vault.util.IntegrationTestSupport;
* Integration test base class for {@link ClientCertificateAuthentication} tests.
*
* @author Mark Paluch
* @author Andy Lintner
*/
public abstract class ClientCertificateAuthenticationIntegrationTestBase extends IntegrationTestSupport {
@@ -52,9 +53,11 @@ public abstract class ClientCertificateAuthenticationIntegrationTestBase extends
Policy.BuiltinCapabilities.UPDATE)
.build());
static final Policy ALTERNATE_POLICY = Policy
.of(Policy.Rule.builder().path("/alternate/*").capabilities(Policy.BuiltinCapabilities.READ,
Policy.BuiltinCapabilities.CREATE, Policy.BuiltinCapabilities.UPDATE).build());
static final Policy ALTERNATE_POLICY = Policy.of(Policy.Rule.builder()
.path("/alternate/*")
.capabilities(Policy.BuiltinCapabilities.READ, Policy.BuiltinCapabilities.CREATE,
Policy.BuiltinCapabilities.UPDATE)
.build());
VaultOperations vaultOperations;
@@ -88,13 +91,15 @@ public abstract class ClientCertificateAuthenticationIntegrationTestBase extends
});
}
ListAssert<String> assertThatPolicies(final VaultToken token) {
ListAssert<String> assertThatPolicies(VaultToken token) {
return assertThat(lookupSelf(token).getBody()).isNotNull()
.extracting("data", as(InstanceOfAssertFactories.map(String.class, Object.class))).isNotNull()
.extracting("policies", as(InstanceOfAssertFactories.list(String.class))).isNotNull();
.extracting("data", as(InstanceOfAssertFactories.map(String.class, Object.class)))
.isNotNull()
.extracting("policies", as(InstanceOfAssertFactories.list(String.class)))
.isNotNull();
}
ResponseEntity<Map<String, Object>> lookupSelf(final VaultToken token) {
ResponseEntity<Map<String, Object>> lookupSelf(VaultToken token) {
return vaultOperations.doWithVault(restOperations -> {
HttpHeaders headers = new HttpHeaders();

9
spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTests.java
View File

@@ -31,6 +31,7 @@ import org.springframework.web.client.RestTemplate;
* Integration tests for {@link ClientCertificateAuthentication}.
*
* @author Mark Paluch
* @author Andy Lintner
*/
class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateAuthenticationIntegrationTestBase {
@@ -90,12 +91,12 @@ class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateA
RestTemplate restTemplate = VaultClients.createRestTemplate(TestRestTemplateFactory.TEST_VAULT_ENDPOINT,
clientHttpRequestFactory);
ClientCertificateAuthentication authentication = new ClientCertificateAuthentication(
ClientCertificateAuthenticationOptions.builder().name("my-default-role").build(), restTemplate);
ClientCertificateAuthenticationOptions.builder().role("my-default-role").build(), restTemplate);
VaultToken login = authentication.login();
assertThat(login.getToken()).isNotEmpty();
assertThatPolicies(login).contains("cert-auth1") //
.doesNotContain("cert-auth2");
.doesNotContain("cert-auth2");
}
@Test
@@ -106,12 +107,12 @@ class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateA
RestTemplate restTemplate = VaultClients.createRestTemplate(TestRestTemplateFactory.TEST_VAULT_ENDPOINT,
clientHttpRequestFactory);
ClientCertificateAuthentication authentication = new ClientCertificateAuthentication(
ClientCertificateAuthenticationOptions.builder().name("my-alternate-role").build(), restTemplate);
ClientCertificateAuthenticationOptions.builder().role("my-alternate-role").build(), restTemplate);
VaultToken login = authentication.login();
assertThat(login.getToken()).isNotEmpty();
assertThatPolicies(login).contains("cert-auth2") //
.doesNotContain("cert-auth1");
.doesNotContain("cert-auth1");
}
// Compatibility for Vault 0.6.0 and below. Vault 0.6.1 fixed that issue and we

20
spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOperatorIntegrationTests.java
View File

@@ -83,14 +83,14 @@ class ClientCertificateAuthenticationOperatorIntegrationTests
AuthenticationStepsOperator operator = new AuthenticationStepsOperator(
ClientCertificateAuthentication.createAuthenticationSteps(
ClientCertificateAuthenticationOptions.builder().name("my-default-role").build()),
ClientCertificateAuthenticationOptions.builder().role("my-default-role").build()),
webClient);
operator.getVaultToken() //
.as(StepVerifier::create) //
.assertNext(token -> assertThatPolicies(token).contains("cert-auth1") //
.doesNotContain("cert-auth2")) //
.verifyComplete();
.as(StepVerifier::create) //
.assertNext(token -> assertThatPolicies(token).contains("cert-auth1") //
.doesNotContain("cert-auth2")) //
.verifyComplete();
}
@Test
@@ -100,14 +100,14 @@ class ClientCertificateAuthenticationOperatorIntegrationTests
AuthenticationStepsOperator operator = new AuthenticationStepsOperator(
ClientCertificateAuthentication.createAuthenticationSteps(
ClientCertificateAuthenticationOptions.builder().name("my-alternate-role").build()),
ClientCertificateAuthenticationOptions.builder().role("my-alternate-role").build()),
webClient);
operator.getVaultToken() //
.as(StepVerifier::create) //
.assertNext(token -> assertThatPolicies(token).contains("cert-auth2") //
.doesNotContain("cert-auth1")) //
.verifyComplete();
.as(StepVerifier::create) //
.assertNext(token -> assertThatPolicies(token).contains("cert-auth2") //
.doesNotContain("cert-auth1")) //
.verifyComplete();
}
@Test

1
spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationStepsIntegrationTests.java
View File

@@ -34,6 +34,7 @@ import static org.assertj.core.api.Assertions.*;
* {@link AuthenticationStepsExecutor}.
*
* @author Mark Paluch
* @author Andy Lintner
*/
class ClientCertificateAuthenticationStepsIntegrationTests extends ClientCertificateAuthenticationIntegrationTestBase {

6
spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationUnitTests.java
View File

@@ -60,13 +60,13 @@ class ClientCertificateAuthenticationUnitTests {
this.mockRest.expect(requestTo("/auth/my/path/login"))
.andExpect(method(HttpMethod.POST))
.andExpect(content().json("{\"name\": \"my-default-role\"}"))
.andRespond(withSuccess().contentType(MediaType.APPLICATION_JSON)
.andRespond(withSuccess().contentType(MediaType.APPLICATION_JSON)
.body("{" + "\"auth\":{\"client_token\":\"my-token\", \"renewable\": true, \"lease_duration\": 10}"
+ "}"));
ClientCertificateAuthenticationOptions options = ClientCertificateAuthenticationOptions.builder()
.name("my-default-role") //
.path("my/path")
.role("my-default-role") //
.path("my/path")
.build();
ClientCertificateAuthentication sut = new ClientCertificateAuthentication(options, this.restTemplate);