Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Refine logging on revocation failures.

Browse Source 
We now log token accessors if a token revocation has failed.

Closes gh-766
This commit is contained in:
Mark Paluch
2023-03-20 09:09:55 +01:00
parent 1d0ff1fb63
commit 62ca6ad40f
3 changed files with 30 additions and 10 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
spring-vault-core/src/main/java/org/springframework/vault/authentication/LifecycleAwareSessionManager.java
View File

@@ -25,6 +25,7 @@ import org.springframework.http.HttpEntity;
import org.springframework.scheduling.TaskScheduler;
import org.springframework.util.Assert;
import org.springframework.util.ClassUtils;
import org.springframework.util.StringUtils;
import org.springframework.vault.VaultException;
import org.springframework.vault.authentication.event.*;
import org.springframework.vault.client.VaultHttpHeaders;
@@ -168,7 +169,14 @@ public class LifecycleAwareSessionManager extends LifecycleAwareSessionManagerSu
dispatch(new AfterLoginTokenRevocationEvent(token));
}
catch (RuntimeException e) {
this.logger.warn(String.format("Cannot revoke VaultToken: %s", token.getToken()), e);
if (LoginToken.hasAccessor(token)) {
this.logger.warn(
String.format("Cannot revoke VaultToken with accessor: %s", ((LoginToken) token).getAccessor()),
e);
}
else {
this.logger.warn("Cannot revoke VaultToken", e);
}
dispatch(new LoginTokenRevocationFailedEvent(token, e));
}
}

7
spring-vault-core/src/main/java/org/springframework/vault/authentication/LoginToken.java
View File

@@ -18,8 +18,11 @@ package org.springframework.vault.authentication;
import java.time.Duration;
import java.util.Arrays;
import org.apache.commons.logging.Log;
import org.springframework.lang.Nullable;
import org.springframework.util.Assert;
import org.springframework.util.StringUtils;
import org.springframework.vault.support.VaultToken;
/**
@@ -132,6 +135,10 @@ public class LoginToken extends VaultToken {
return new LoginToken(token, leaseDuration, true, null, null);
}
static boolean hasAccessor(VaultToken token) {
return token instanceof LoginToken && StringUtils.hasText(((LoginToken) token).getAccessor());
}
/**
* @return the lease duration in seconds. May be {@literal 0} if none.
*/

23
spring-vault-core/src/main/java/org/springframework/vault/authentication/ReactiveLifecycleAwareSessionManager.java
View File

@@ -26,6 +26,7 @@ import org.springframework.beans.factory.DisposableBean;
import org.springframework.scheduling.TaskScheduler;
import org.springframework.util.Assert;
import org.springframework.util.ClassUtils;
import org.springframework.util.StringUtils;
import org.springframework.vault.VaultException;
import org.springframework.vault.authentication.event.*;
import org.springframework.vault.client.VaultHttpHeaders;
@@ -168,19 +169,23 @@ public class ReactiveLifecycleAwareSessionManager extends LifecycleAwareSessionM
}).retrieve().bodyToMono(String.class)
.doOnSubscribe(ignore -> dispatch(new BeforeLoginTokenRevocationEvent(token)))
.doOnNext(ignore -> dispatch(new AfterLoginTokenRevocationEvent(token)))
.onErrorResume(WebClientResponseException.class, e -> {
.onErrorResume(WebClientResponseException.class, e -> onRevokeFailed(token, e))
.onErrorResume(Exception.class, e -> onRevokeFailed(token, e)).then();
}
this.logger.warn(format("Could not revoke token", e));
dispatch(new LoginTokenRevocationFailedEvent(token, e));
private Mono<String> onRevokeFailed(VaultToken token, Throwable e) {
return Mono.empty();
}).onErrorResume(Exception.class, e -> {
if (LoginToken.hasAccessor(token)) {
this.logger.warn(
String.format("Cannot revoke VaultToken with accessor: %s", ((LoginToken) token).getAccessor()), e);
}
else {
this.logger.warn("Cannot revoke VaultToken", e);
}
this.logger.warn("Could not revoke token", e);
dispatch(new LoginTokenRevocationFailedEvent(token, e));
dispatch(new LoginTokenRevocationFailedEvent(token, e));
return Mono.empty();
}).then();
return Mono.empty();
}
/**