diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java index 18742152..457e901e 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java @@ -15,13 +15,23 @@ */ package org.springframework.vault.authentication; -import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.post; - import java.util.Collections; import java.util.Map; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; + +import org.springframework.util.Assert; +import org.springframework.vault.support.VaultResponse; +import org.springframework.vault.support.VaultToken; +import org.springframework.web.client.RestClientException; +import org.springframework.web.client.RestOperations; + +import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.*; + +import org.apache.commons.logging.Log; +import org.apache.commons.logging.LogFactory; + import org.springframework.util.Assert; import org.springframework.vault.support.VaultResponse; import org.springframework.vault.support.VaultToken; @@ -32,6 +42,7 @@ import org.springframework.web.client.RestOperations; * TLS Client Certificate {@link ClientAuthentication}. * * @author Mark Paluch + * @author Andy Lintner */ public class ClientCertificateAuthentication implements ClientAuthentication, AuthenticationStepsFactory { @@ -83,8 +94,7 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au public static AuthenticationSteps createAuthenticationSteps(ClientCertificateAuthenticationOptions options) { Assert.notNull(options, "ClientCertificateAuthenticationOptions must not be null"); - String name = options.getName(); - Map body = name != null ? Collections.singletonMap("name", name) : Collections.emptyMap(); + Map body = getRequestBody(options); return AuthenticationSteps.fromSupplier(() -> body) .login(post(AuthenticationUtil.getLoginPath(options.getPath())).as(VaultResponse.class)); @@ -103,12 +113,9 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au private VaultToken createTokenUsingTlsCertAuthentication() { try { - String name = this.options.getName(); - - VaultResponse response = this.restOperations.postForObject( - AuthenticationUtil.getLoginPath(this.options.getPath()), - name != null ? Collections.singletonMap("name", name) : Collections.emptyMap(), - VaultResponse.class); + Map request = getRequestBody(this.options); + VaultResponse response = this.restOperations + .postForObject(AuthenticationUtil.getLoginPath(this.options.getPath()), request, VaultResponse.class); Assert.state(response.getAuth() != null, "Auth field must not be null"); @@ -121,4 +128,10 @@ public class ClientCertificateAuthentication implements ClientAuthentication, Au } } + private static Map getRequestBody(ClientCertificateAuthenticationOptions options) { + String name = options.getRole(); + + return name != null ? Collections.singletonMap("name", name) : Collections.emptyMap(); + } + } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOptions.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOptions.java index 630f3b9f..4d5b2c3a 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOptions.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOptions.java @@ -26,6 +26,7 @@ import org.springframework.util.Assert; * constructed. * * @author Mark Paluch + * @author Andy Lintner * @since 2.3 * @see ClientCertificateAuthenticationOptions * @see #builder() @@ -40,14 +41,14 @@ public class ClientCertificateAuthenticationOptions { private final String path; /** - * Optional named certificate role to authenticate against. + * Named certificate role to authenticate against. Can be {@literal null}. */ @Nullable - private final String name; + private final String role; - private ClientCertificateAuthenticationOptions(String path, String name) { + private ClientCertificateAuthenticationOptions(String path, @Nullable String role) { this.path = path; - this.name = name; + this.role = role; } /** @@ -66,10 +67,11 @@ public class ClientCertificateAuthenticationOptions { /** * @return the optional named certificate role to authenticate against. + * @since 2.3.4 */ @Nullable - public String getName() { - return this.name; + public String getRole() { + return this.role; } /** @@ -80,7 +82,7 @@ public class ClientCertificateAuthenticationOptions { private String path = DEFAULT_CERT_PATH; @Nullable - private String name; + private String role; ClientCertificateAuthenticationOptionsBuilder() { } @@ -102,12 +104,13 @@ public class ClientCertificateAuthenticationOptions { * Configure the named certificate role to authenticate against. * @param name must not be empty or {@literal null}. * @return {@code this} {@link ClientCertificateAuthenticationOptionsBuilder}. + * @since 2.3.4 */ - public ClientCertificateAuthenticationOptionsBuilder name(String name) { + public ClientCertificateAuthenticationOptionsBuilder role(String name) { - Assert.hasText(name, "Name must not be empty"); + Assert.hasText(name, "Role must not be empty"); - this.name = name; + this.role = name; return this; } @@ -116,7 +119,7 @@ public class ClientCertificateAuthenticationOptions { * @return a new {@link ClientCertificateAuthenticationOptions}. */ public ClientCertificateAuthenticationOptions build() { - return new ClientCertificateAuthenticationOptions(this.path, this.name); + return new ClientCertificateAuthenticationOptions(this.path, this.role); } } diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTestBase.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTestBase.java index 24b4a145..87928bc6 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTestBase.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTestBase.java @@ -43,6 +43,7 @@ import org.springframework.vault.util.IntegrationTestSupport; * Integration test base class for {@link ClientCertificateAuthentication} tests. * * @author Mark Paluch + * @author Andy Lintner */ public abstract class ClientCertificateAuthenticationIntegrationTestBase extends IntegrationTestSupport { @@ -52,9 +53,11 @@ public abstract class ClientCertificateAuthenticationIntegrationTestBase extends Policy.BuiltinCapabilities.UPDATE) .build()); - static final Policy ALTERNATE_POLICY = Policy - .of(Policy.Rule.builder().path("/alternate/*").capabilities(Policy.BuiltinCapabilities.READ, - Policy.BuiltinCapabilities.CREATE, Policy.BuiltinCapabilities.UPDATE).build()); + static final Policy ALTERNATE_POLICY = Policy.of(Policy.Rule.builder() + .path("/alternate/*") + .capabilities(Policy.BuiltinCapabilities.READ, Policy.BuiltinCapabilities.CREATE, + Policy.BuiltinCapabilities.UPDATE) + .build()); VaultOperations vaultOperations; @@ -88,13 +91,15 @@ public abstract class ClientCertificateAuthenticationIntegrationTestBase extends }); } - ListAssert assertThatPolicies(final VaultToken token) { + ListAssert assertThatPolicies(VaultToken token) { return assertThat(lookupSelf(token).getBody()).isNotNull() - .extracting("data", as(InstanceOfAssertFactories.map(String.class, Object.class))).isNotNull() - .extracting("policies", as(InstanceOfAssertFactories.list(String.class))).isNotNull(); + .extracting("data", as(InstanceOfAssertFactories.map(String.class, Object.class))) + .isNotNull() + .extracting("policies", as(InstanceOfAssertFactories.list(String.class))) + .isNotNull(); } - ResponseEntity> lookupSelf(final VaultToken token) { + ResponseEntity> lookupSelf(VaultToken token) { return vaultOperations.doWithVault(restOperations -> { HttpHeaders headers = new HttpHeaders(); diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTests.java index 37aca5e5..f443a29d 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationIntegrationTests.java @@ -31,6 +31,7 @@ import org.springframework.web.client.RestTemplate; * Integration tests for {@link ClientCertificateAuthentication}. * * @author Mark Paluch + * @author Andy Lintner */ class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateAuthenticationIntegrationTestBase { @@ -90,12 +91,12 @@ class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateA RestTemplate restTemplate = VaultClients.createRestTemplate(TestRestTemplateFactory.TEST_VAULT_ENDPOINT, clientHttpRequestFactory); ClientCertificateAuthentication authentication = new ClientCertificateAuthentication( - ClientCertificateAuthenticationOptions.builder().name("my-default-role").build(), restTemplate); + ClientCertificateAuthenticationOptions.builder().role("my-default-role").build(), restTemplate); VaultToken login = authentication.login(); assertThat(login.getToken()).isNotEmpty(); assertThatPolicies(login).contains("cert-auth1") // - .doesNotContain("cert-auth2"); + .doesNotContain("cert-auth2"); } @Test @@ -106,12 +107,12 @@ class ClientCertificateAuthenticationIntegrationTests extends ClientCertificateA RestTemplate restTemplate = VaultClients.createRestTemplate(TestRestTemplateFactory.TEST_VAULT_ENDPOINT, clientHttpRequestFactory); ClientCertificateAuthentication authentication = new ClientCertificateAuthentication( - ClientCertificateAuthenticationOptions.builder().name("my-alternate-role").build(), restTemplate); + ClientCertificateAuthenticationOptions.builder().role("my-alternate-role").build(), restTemplate); VaultToken login = authentication.login(); assertThat(login.getToken()).isNotEmpty(); assertThatPolicies(login).contains("cert-auth2") // - .doesNotContain("cert-auth1"); + .doesNotContain("cert-auth1"); } // Compatibility for Vault 0.6.0 and below. Vault 0.6.1 fixed that issue and we diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOperatorIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOperatorIntegrationTests.java index e02e7550..70ebc011 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOperatorIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationOperatorIntegrationTests.java @@ -83,14 +83,14 @@ class ClientCertificateAuthenticationOperatorIntegrationTests AuthenticationStepsOperator operator = new AuthenticationStepsOperator( ClientCertificateAuthentication.createAuthenticationSteps( - ClientCertificateAuthenticationOptions.builder().name("my-default-role").build()), + ClientCertificateAuthenticationOptions.builder().role("my-default-role").build()), webClient); operator.getVaultToken() // - .as(StepVerifier::create) // - .assertNext(token -> assertThatPolicies(token).contains("cert-auth1") // - .doesNotContain("cert-auth2")) // - .verifyComplete(); + .as(StepVerifier::create) // + .assertNext(token -> assertThatPolicies(token).contains("cert-auth1") // + .doesNotContain("cert-auth2")) // + .verifyComplete(); } @Test @@ -100,14 +100,14 @@ class ClientCertificateAuthenticationOperatorIntegrationTests AuthenticationStepsOperator operator = new AuthenticationStepsOperator( ClientCertificateAuthentication.createAuthenticationSteps( - ClientCertificateAuthenticationOptions.builder().name("my-alternate-role").build()), + ClientCertificateAuthenticationOptions.builder().role("my-alternate-role").build()), webClient); operator.getVaultToken() // - .as(StepVerifier::create) // - .assertNext(token -> assertThatPolicies(token).contains("cert-auth2") // - .doesNotContain("cert-auth1")) // - .verifyComplete(); + .as(StepVerifier::create) // + .assertNext(token -> assertThatPolicies(token).contains("cert-auth2") // + .doesNotContain("cert-auth1")) // + .verifyComplete(); } @Test diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationStepsIntegrationTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationStepsIntegrationTests.java index e86f7e22..4724cfd4 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationStepsIntegrationTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationStepsIntegrationTests.java @@ -34,6 +34,7 @@ import static org.assertj.core.api.Assertions.*; * {@link AuthenticationStepsExecutor}. * * @author Mark Paluch + * @author Andy Lintner */ class ClientCertificateAuthenticationStepsIntegrationTests extends ClientCertificateAuthenticationIntegrationTestBase { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationUnitTests.java index 2f48d34b..b9bd8bd6 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationUnitTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/authentication/ClientCertificateAuthenticationUnitTests.java @@ -60,13 +60,13 @@ class ClientCertificateAuthenticationUnitTests { this.mockRest.expect(requestTo("/auth/my/path/login")) .andExpect(method(HttpMethod.POST)) .andExpect(content().json("{\"name\": \"my-default-role\"}")) - .andRespond(withSuccess().contentType(MediaType.APPLICATION_JSON) + .andRespond(withSuccess().contentType(MediaType.APPLICATION_JSON) .body("{" + "\"auth\":{\"client_token\":\"my-token\", \"renewable\": true, \"lease_duration\": 10}" + "}")); ClientCertificateAuthenticationOptions options = ClientCertificateAuthenticationOptions.builder() - .name("my-default-role") // - .path("my/path") + .role("my-default-role") // + .path("my/path") .build(); ClientCertificateAuthentication sut = new ClientCertificateAuthentication(options, this.restTemplate);