Polishing.

Add builder for VaultTokenRequest. Add missing linebreaks. Improve documentation.

spring-vault-core/src/main/java/org/springframework/vault/core/VaultTokenTemplate.java

@@ -48,7 +48,7 @@ public class VaultTokenTemplate implements VaultTokenOperations {
 
 	@Override
 	public VaultTokenResponse create() {
-		return create(new VaultTokenRequest());
+		return create(VaultTokenRequest.builder().build());
 	}
 
 	@Override
@@ -61,7 +61,7 @@ public class VaultTokenTemplate implements VaultTokenOperations {
 
 	@Override
 	public VaultTokenResponse createOrphan() {
-		return createOrphan(new VaultTokenRequest());
+		return createOrphan(VaultTokenRequest.builder().build());
 	}
 
 	@Override

spring-vault-core/src/main/java/org/springframework/vault/support/SslConfiguration.java

@@ -59,6 +59,14 @@ public class SslConfiguration {
 	 */
 	private final String trustStorePassword;
 
+	/**
+	 * Creates a new {@link SslConfiguration}.
+	 *
+	 * @param keyStore
+	 * @param keyStorePassword
+	 * @param trustStore
+	 * @param trustStorePassword
+	 */
 	public SslConfiguration(Resource keyStore, String keyStorePassword,
 			Resource trustStore, String trustStorePassword) {
 

spring-vault-core/src/main/java/org/springframework/vault/support/VaultCertificateRequest.java

@@ -130,7 +130,7 @@ public class VaultCertificateRequest {
 		}
 
 		/**
-		 * Configure alternative names. Replaces previously configured alt names
+		 * Configure alternative names. Replaces previously configured alt names.
 		 *
 		 * @param altNames must not be {@literal null}.
 		 * @return {@code this} {@link VaultCertificateRequestBuilder}.
@@ -272,10 +272,12 @@ public class VaultCertificateRequest {
 		}
 
 		private static <E> List<E> toList(Iterable<E> iter) {
+
 			List<E> list = new ArrayList<E>();
 			for (E item : iter) {
 				list.add(item);
 			}
+
 			return list;
 		}
 	}

spring-vault-core/src/main/java/org/springframework/vault/support/VaultMount.java

@@ -113,7 +113,7 @@ public class VaultMount {
 		 * @param type the backend type, must not be empty or {@literal null}.
 		 * @return {@literal this} {@link VaultMountBuilder}.
 		 */
-		public VaultMount.VaultMountBuilder type(String type) {
+		public VaultMountBuilder type(String type) {
 
 			Assert.hasText(type, "Type must not be empty or null");
 
@@ -127,7 +127,7 @@ public class VaultMount {
 		 * @param description a human readable description of this mount.
 		 * @return {@literal this} {@link VaultMountBuilder}.
 		 */
-		public VaultMount.VaultMountBuilder description(String description) {
+		public VaultMountBuilder description(String description) {
 			this.description = description;
 			return this;
 		}
@@ -138,7 +138,7 @@ public class VaultMount {
 		 * @param config additional configuration details for this mount.
 		 * @return {@literal this} {@link VaultMountBuilder}.
 		 */
-		public VaultMount.VaultMountBuilder config(Map<String, Object> config) {
+		public VaultMountBuilder config(Map<String, Object> config) {
 			this.config = config;
 			return this;
 		}

spring-vault-core/src/main/java/org/springframework/vault/support/VaultResponseSupport.java

@@ -51,66 +51,130 @@ public class VaultResponseSupport<T> {
 
 	private boolean renewable;
 
+	/**
+	 *
+	 * @return authentication payload.
+	 */
 	public Map<String, Object> getAuth() {
 		return auth;
 	}
 
+	/**
+	 *
+	 * @param auth the authentication payload.
+	 */
 	public void setAuth(Map<String, Object> auth) {
 		this.auth = auth;
 	}
 
+	/**
+	 *
+	 * @return secret data.
+	 */
 	public T getData() {
 		return data;
 	}
 
+	/**
+	 *
+	 * @param data secret data.
+	 */
 	public void setData(T data) {
 		this.data = data;
 	}
 
+	/**
+	 *
+	 * @return request metadata.
+	 */
 	public Map<String, String> getMetadata() {
 		return metadata;
 	}
 
+	/**
+	 *
+	 * @param metadata request metadata.
+	 */
 	public void setMetadata(Map<String, String> metadata) {
 		this.metadata = metadata;
 	}
 
+	/**
+	 *
+	 * @return the lease duration.
+	 */
 	public long getLeaseDuration() {
 		return leaseDuration;
 	}
 
+	/**
+	 *
+	 * @param leaseDuration the lease duration.
+	 */
 	public void setLeaseDuration(long leaseDuration) {
 		this.leaseDuration = leaseDuration;
 	}
 
+	/**
+	 *
+	 * @return the lease Id.
+	 */
 	public String getLeaseId() {
 		return leaseId;
 	}
 
+	/**
+	 *
+	 * @param leaseId the lease Id.
+	 */
 	public void setLeaseId(String leaseId) {
 		this.leaseId = leaseId;
 	}
 
+	/**
+	 *
+	 * @return {@literal true} if the lease is renewable.
+	 */
 	public boolean isRenewable() {
 		return renewable;
 	}
 
+	/**
+	 *
+	 * @param renewable {@literal true} if the lease is renewable.
+	 */
 	public void setRenewable(boolean renewable) {
 		this.renewable = renewable;
 	}
 
+	/**
+	 *
+	 * @return response wrapping details.
+	 */
 	public Map<String, String> getWrapInfo() {
 		return wrapInfo;
 	}
 
+	/**
+	 *
+	 * @param wrapInfo response wrapping details.
+	 */
 	public void setWrapInfo(Map<String, String> wrapInfo) {
 		this.wrapInfo = wrapInfo;
 	}
 
+	/**
+	 *
+	 * @return the request Id.
+	 */
 	public String getRequestId() {
 		return requestId;
 	}
 
+	/**
+	 *
+	 * @param requestId the request Id.
+	 */
 	public void setRequestId(String requestId) {
 		this.requestId = requestId;
 	}

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTokenRequest.java

@@ -15,11 +15,17 @@
  */
 package org.springframework.vault.support;
 
+import java.util.ArrayList;
+import java.util.Collections;
+import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.TimeUnit;
 
 import com.fasterxml.jackson.annotation.JsonProperty;
 
+import org.springframework.util.Assert;
+
 /**
  * Value object to bind Vault HTTP Token API requests.
  * 
@@ -27,108 +33,413 @@ import com.fasterxml.jackson.annotation.JsonProperty;
  */
 public class VaultTokenRequest {
 
-	private String id;
+	private final String id;
 
-	private List<String> policies;
+	private final List<String> policies;
 
-	private Map<String, String> meta;
+	private final Map<String, String> meta;
 
-	@JsonProperty("no_parent")
-	private Boolean noParent;
+	private final Boolean noParent;
 
 	@JsonProperty("no_default_policy")
-	private Boolean noDefaultPolicy;
+	private final Boolean noDefaultPolicy;
 
-	private Boolean renewable;
+	private final Boolean renewable;
 
-	private String ttl;
+	private final String ttl;
 
 	@JsonProperty("explicit_max_ttl")
-	private String explicitMaxTtl;
+	private final String explicitMaxTtl;
 
 	@JsonProperty("display_name")
-	private String displayName;
+	private final String displayName;
 
 	@JsonProperty("num_uses")
-	private Integer numUses;
+	private final Integer numUses;
 
+	VaultTokenRequest(String id, List<String> policies, Map<String, String> meta,
+			Boolean noParent, Boolean noDefaultPolicy, Boolean renewable, String ttl,
+			String explicitMaxTtl, String displayName, Integer numUses) {
+
+		this.id = id;
+		this.policies = policies;
+		this.meta = meta;
+		this.noParent = noParent;
+		this.noDefaultPolicy = noDefaultPolicy;
+		this.renewable = renewable;
+		this.ttl = ttl;
+		this.explicitMaxTtl = explicitMaxTtl;
+		this.displayName = displayName;
+		this.numUses = numUses;
+	}
+
+	/**
+	 * @return a new {@link VaultTokenRequestBuilder}.
+	 */
+	public static VaultTokenRequestBuilder builder() {
+		return new VaultTokenRequestBuilder();
+	}
+
+	/**
+	 *
+	 * @return Id of the client token.
+	 */
 	public String getId() {
 		return id;
 	}
 
-	public void setId(String id) {
-		this.id = id;
-	}
-
+	/**
+	 *
+	 * @return policies for the token.
+	 */
 	public List<String> getPolicies() {
 		return policies;
 	}
 
-	public void setPolicies(List<String> policies) {
-		this.policies = policies;
-	}
-
+	/**
+	 *
+	 * @return map of string to string valued metadata, passed through to the audit
+	 * backends.
+	 */
 	public Map<String, String> getMeta() {
 		return meta;
 	}
 
-	public void setMeta(Map<String, String> meta) {
-		this.meta = meta;
-	}
-
+	/**
+	 *
+	 * @return {@literal true} if the token should not have the parent.
+	 */
 	public Boolean getNoParent() {
 		return noParent;
 	}
 
-	public void setNoParent(Boolean noParent) {
-		this.noParent = noParent;
-	}
-
+	/**
+	 *
+	 * @return {@literal true} if the default policy should not be be applied.
+	 */
 	public Boolean getNoDefaultPolicy() {
 		return noDefaultPolicy;
 	}
 
-	public void setNoDefaultPolicy(Boolean noDefaultPolicy) {
-		this.noDefaultPolicy = noDefaultPolicy;
-	}
-
+	/**
+	 *
+	 * @return {@literal true} if then the token should be renewable.
+	 */
 	public Boolean getRenewable() {
 		return renewable;
 	}
 
-	public void setRenewable(Boolean renewable) {
-		this.renewable = renewable;
-	}
-
+	/**
+	 *
+	 * @return TTL period of the token.
+	 */
 	public String getTtl() {
 		return ttl;
 	}
 
-	public void setTtl(String ttl) {
-		this.ttl = ttl;
-	}
-
+	/**
+	 *
+	 * @return explicit TTL of the token.
+	 */
 	public String getExplicitMaxTtl() {
 		return explicitMaxTtl;
 	}
 
-	public void setExplicitMaxTtl(String explicitMaxTtl) {
-		this.explicitMaxTtl = explicitMaxTtl;
-	}
-
+	/**
+	 *
+	 * @return the display name.
+	 */
 	public String getDisplayName() {
 		return displayName;
 	}
 
-	public void setDisplayName(String displayName) {
-		this.displayName = displayName;
-	}
-
+	/**
+	 *
+	 * @return the number of allowed token uses.
+	 */
 	public Integer getNumUses() {
 		return numUses;
 	}
 
-	public void setNumUses(Integer numUses) {
-		this.numUses = numUses;
+	/**
+	 * Builder to build a {@link VaultTokenRequest}.
+	 */
+	public static class VaultTokenRequestBuilder {
+
+		private String id;
+
+		private List<String> policies = new ArrayList<String>();
+
+		private Map<String, String> meta = new LinkedHashMap<String, String>();
+
+		private Boolean noParent;
+
+		private Boolean noDefaultPolicy;
+
+		private Boolean renewable;
+
+		private String ttl;
+
+		private String explicitMaxTtl;
+
+		private String displayName;
+
+		private Integer numUses;
+
+		VaultTokenRequestBuilder() {
+		}
+
+		/**
+		 * Configure a the Id of the client token. Can only be specified by a root token.
+		 * Otherwise, the token Id is a randomly generated UUID.
+		 *
+		 * @param id the token Id.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder id(String id) {
+			this.id = id;
+			return this;
+		}
+
+		/**
+		 * Configure policies. Replaces previously configured policies.
+		 *
+		 * @param policies must not be {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder policies(Iterable<String> policies) {
+
+			Assert.notNull(policies, "Policies must not be null");
+
+			this.policies = toList(policies);
+			return this;
+		}
+
+		/**
+		 * Add a policy.
+		 *
+		 * @param policy must not be empty or {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder withPolicy(String policy) {
+
+			Assert.hasText(policy, "Policy must not be empty");
+
+			this.policies.add(policy);
+			return this;
+		}
+
+		/**
+		 * Configure meta. Replaces previously meta.
+		 *
+		 * @param meta must not be {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder meta(Map<String, String> meta) {
+
+			Assert.notNull(meta, "Meta must not be null");
+
+			this.meta = meta;
+			return this;
+		}
+
+		/**
+		 * Configure the token to not have the parent token of the caller. This creates a
+		 * token with no parent. Requires a root caller.
+		 *
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder noParent() {
+			return noParent(true);
+		}
+
+		/**
+		 * Configure the token to not have the parent token of the caller. This creates a
+		 * token with no parent. Requires a root caller.
+		 *
+		 * @param noParent {@literal true} to not have the parent token of the caller.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder noParent(boolean noParent) {
+			this.noParent = noParent;
+			return this;
+		}
+
+		/**
+		 * Omit the default policy in the token's policy set
+		 *
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder noDefaultPolicy() {
+			return noDefaultPolicy(true);
+		}
+
+		/**
+		 * Configure whether the default policy should be part of the token's policy set.
+		 *
+		 * @param noDefaultPolicy {@literal true} to omit the default policy in the
+		 * token's policy set.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder noDefaultPolicy(boolean noDefaultPolicy) {
+			this.noDefaultPolicy = noDefaultPolicy;
+			return this;
+		}
+
+		/**
+		 * Enable TTL extension/renewal for the token.
+		 *
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder renewable() {
+			return renewable(true);
+		}
+
+		/**
+		 * Configure TTL extension/renewal for the token.
+		 *
+		 * @param renewable {@literal false} to disable the ability of the token to be
+		 * renewed past its initial TTL. {@literal true}, or omitting this option, will
+		 * allow the token to be renewable up to the system/mount maximum TTL.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder renewable(boolean renewable) {
+			this.renewable = renewable;
+			return this;
+		}
+
+		/**
+		 * Configure a TTL (seconds) for the token.
+		 *
+		 * @param ttl the time to live in seconds, must not be negative.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder ttl(long ttl) {
+			return ttl(ttl, TimeUnit.SECONDS);
+		}
+
+		/**
+		 * Configure a TTL (seconds) for the token.
+		 *
+		 * @param ttl the time to live, must not be negative.
+		 * @param timeUnit the time to live, must not be {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder ttl(long ttl, TimeUnit timeUnit) {
+
+			Assert.isTrue(ttl >= 0, "TTL must not be negative");
+			Assert.notNull(timeUnit, "TimeUnit must not be null");
+
+			this.ttl = String.format("%ss", timeUnit.toSeconds(ttl));
+			return this;
+		}
+
+		/**
+		 * Configure the explicit maximum TTL (seconds) for the token. This maximum token
+		 * TTL cannot be changed later, and unlike with normal tokens, updates to the
+		 * system/mount max TTL value will have no effect at renewal time - the token will
+		 * never be able to be renewed or used past the value set at issue time.
+		 *
+		 * @param explicitMaxTtl the time to live in seconds, must not be negative.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder explicitMaxTtl(long explicitMaxTtl) {
+			return explicitMaxTtl(explicitMaxTtl, TimeUnit.SECONDS);
+		}
+
+		/**
+		 * Configure the explicit maximum TTL for the token. This maximum token TTL cannot
+		 * be changed later, and unlike with normal tokens, updates to the system/mount
+		 * max TTL value will have no effect at renewal time - the token will never be
+		 * able to be renewed or used past the value set at issue time.
+		 *
+		 * @param explicitMaxTtl the time to live, must not be negative.
+		 * @param timeUnit the time to live, must not be {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder explicitMaxTtl(long explicitMaxTtl,
+				TimeUnit timeUnit) {
+
+			Assert.isTrue(explicitMaxTtl >= 0, "TTL must not be negative");
+			Assert.notNull(timeUnit, "TimeUnit must not be null");
+
+			this.explicitMaxTtl = String
+					.format("%ss", timeUnit.toSeconds(explicitMaxTtl));
+			return this;
+		}
+
+		/**
+		 * Configure the maximum uses for the token. This can be used to create a
+		 * one-time-token or limited use token. Defaults to {@literal 0}, which has no
+		 * limit to the number of uses.
+		 *
+		 * @param numUses number of uses, must not be negative.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder numUses(int numUses) {
+
+			Assert.isTrue(numUses >= 0, "Number of uses must not be negative");
+
+			this.numUses = numUses;
+			return this;
+		}
+
+		/**
+		 * Configure a display name for the token, defaults to "token".
+		 *
+		 * @param displayName must not be empty or {@literal null}.
+		 * @return {@code this} {@link VaultTokenRequestBuilder}.
+		 */
+		public VaultTokenRequestBuilder displayName(String displayName) {
+
+			Assert.hasText(displayName, "Display name must not be empty");
+
+			this.displayName = displayName;
+			return this;
+		}
+
+		/**
+		 * Build a new {@link VaultTokenRequest} instance.
+		 *
+		 * @return a new {@link VaultCertificateRequest}.
+		 */
+		public VaultTokenRequest build() {
+
+			List<String> policies;
+			switch (this.policies.size()) {
+			case 0:
+				policies = Collections.emptyList();
+				break;
+			case 1:
+				policies = Collections.singletonList(this.policies.get(0));
+				break;
+			default:
+				policies = Collections.unmodifiableList(new ArrayList<String>(
+						this.policies));
+
+			}
+			Map<String, String> meta = null;
+			switch (this.meta.size()) {
+			case 0:
+				meta = Collections.emptyMap();
+				break;
+			default:
+				meta = Collections
+						.unmodifiableMap(new LinkedHashMap<String, String>(meta));
+			}
+
+			return new VaultTokenRequest(id, policies, meta, noParent, noDefaultPolicy,
+					renewable, ttl, explicitMaxTtl, displayName, numUses);
+		}
+
+		private static <E> List<E> toList(Iterable<E> iter) {
+
+			List<E> list = new ArrayList<E>();
+			for (E item : iter) {
+				list.add(item);
+			}
+
+			return list;
+		}
 	}
 }

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitContext.java

@@ -58,6 +58,7 @@ public class VaultTransitContext {
 	public static class VaultTransitRequestBuilder {
 
 		private byte[] context;
+
 		private byte[] nonce;
 
 		VaultTransitRequestBuilder() {
@@ -70,7 +71,7 @@ public class VaultTransitContext {
 		 * provided if derivation is enabled.
 		 * @return {@code this} {@link VaultTransitRequestBuilder}.
 		 */
-		public VaultTransitContext.VaultTransitRequestBuilder context(byte[] context) {
+		public VaultTransitRequestBuilder context(byte[] context) {
 			this.context = context;
 			return this;
 		}
@@ -85,7 +86,7 @@ public class VaultTransitContext {
 		 * nonce value is never reused
 		 * @return {@code this} {@link VaultTransitRequestBuilder}.
 		 */
-		public VaultTransitContext.VaultTransitRequestBuilder nonce(byte[] nonce) {
+		public VaultTransitRequestBuilder nonce(byte[] nonce) {
 			this.nonce = nonce;
 			return this;
 		}

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyConfiguration.java

@@ -62,6 +62,7 @@ public class VaultTransitKeyConfiguration {
 	public static class VaultTransitKeyConfigurationBuilder {
 
 		private Boolean deletionAllowed;
+
 		private Integer latestVersion;
 
 		VaultTransitKeyConfigurationBuilder() {
@@ -97,6 +98,5 @@ public class VaultTransitKeyConfiguration {
 		public VaultTransitKeyConfiguration build() {
 			return new VaultTransitKeyConfiguration(deletionAllowed, latestVersion);
 		}
-
 	}
 }

spring-vault-core/src/main/java/org/springframework/vault/support/VaultTransitKeyCreationRequest.java

@@ -48,14 +48,27 @@ public class VaultTransitKeyCreationRequest {
 		return new VaultTransitKeyCreationRequestBuilder();
 	}
 
+	/**
+	 *
+	 * @return {@literal true} if key derivation MUST be used.
+	 */
 	public Boolean getDerived() {
 		return derived;
 	}
 
+	/**
+	 *
+	 * @return {@literal true} if convergent encryption should be used (where the same
+	 * plaintext creates the same cipher text).
+	 */
 	public Boolean getConvergentEncryption() {
 		return convergentEncryption;
 	}
 
+	/**
+	 *
+	 * @return the key type.
+	 */
 	public String getType() {
 		return type;
 	}

spring-vault-core/src/test/java/org/springframework/vault/authentication/LifecycleAwareSessionManagerIntegrationTests.java

@@ -16,6 +16,7 @@
 package org.springframework.vault.authentication;
 
 import java.util.Map;
+import java.util.concurrent.TimeUnit;
 import java.util.concurrent.atomic.AtomicInteger;
 
 import org.junit.Test;
@@ -60,10 +61,10 @@ public class LifecycleAwareSessionManagerIntegrationTests extends IntegrationTes
 		VaultTokenOperations tokenOperations = prepare().getVaultOperations()
 				.opsForToken();
 
-		VaultTokenRequest tokenRequest = new VaultTokenRequest();
-		tokenRequest.setRenewable(true);
-		tokenRequest.setTtl("1h");
-		tokenRequest.setExplicitMaxTtl("10h");
+		VaultTokenRequest tokenRequest = VaultTokenRequest.builder() //
+				.renewable().ttl(1, TimeUnit.HOURS) //
+				.explicitMaxTtl(10, TimeUnit.HOURS) //
+				.build();
 
 		VaultToken token = tokenOperations.create(tokenRequest).getToken();
 

spring-vault-core/src/test/java/org/springframework/vault/core/VaultTokenTemplateIntegrationTests.java

@@ -16,6 +16,7 @@
 package org.springframework.vault.core;
 
 import java.util.Collections;
+import java.util.concurrent.TimeUnit;
 
 import org.junit.Before;
 import org.junit.Test;
@@ -62,14 +63,17 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport {
 	@Test
 	public void createTokenShouldCreateACustomizedToken() {
 
-		VaultTokenRequest tokenRequest = new VaultTokenRequest();
-		tokenRequest.setDisplayName("display");
-		tokenRequest.setExplicitMaxTtl("1h");
-		tokenRequest.setTtl("30m");
-		tokenRequest.setPolicies(Collections.singletonList("root"));
-		tokenRequest.setNumUses(2);
-		tokenRequest.setRenewable(true);
-		tokenRequest.setId("HELLO-WORLD");
+		VaultTokenRequest tokenRequest = VaultTokenRequest.builder()
+				.displayName("display") //
+				.explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) //
+				.ttl(30 * 60) //
+				.policies(Collections.singleton("root")) //
+				.numUses(2) //
+				.renewable() //
+				.noDefaultPolicy() //
+				.noParent() //
+				.id("HELLO-WORLD") //
+				.build();
 
 		VaultTokenResponse tokenResponse = tokenOperations.create(tokenRequest);
 		assertThat(tokenResponse.getAuth()).containsEntry("client_token",
@@ -86,14 +90,17 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport {
 	@Test
 	public void createOrphanTokenShouldCreateACustomizedToken() {
 
-		VaultTokenRequest tokenRequest = new VaultTokenRequest();
-		tokenRequest.setDisplayName("display");
-		tokenRequest.setExplicitMaxTtl("1h");
-		tokenRequest.setTtl("30m");
-		tokenRequest.setPolicies(Collections.singletonList("root"));
-		tokenRequest.setNumUses(2);
-		tokenRequest.setRenewable(true);
-		tokenRequest.setId("HELLO-WORLD");
+		VaultTokenRequest tokenRequest = VaultTokenRequest.builder()
+				.displayName("display") //
+				.explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) //
+				.ttl(30 * 60) //
+				.policies(Collections.singleton("root")) //
+				.numUses(2) //
+				.renewable() //
+				.noDefaultPolicy() //
+				.noParent() //
+				.id("HELLO-WORLD") //
+				.build();
 
 		VaultTokenResponse tokenResponse = tokenOperations.createOrphan(tokenRequest);
 		assertThat(tokenResponse.getAuth()).containsEntry("client_token",
@@ -103,10 +110,11 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport {
 	@Test
 	public void renewShouldRenewToken() {
 
-		VaultTokenRequest tokenRequest = new VaultTokenRequest();
-		tokenRequest.setDisplayName("display");
-		tokenRequest.setExplicitMaxTtl("1h");
-		tokenRequest.setTtl("30m");
+		VaultTokenRequest tokenRequest = VaultTokenRequest.builder()
+				.explicitMaxTtl(TimeUnit.HOURS.toSeconds(10)) //
+				.ttl(30 * 60) //
+				.renewable() //
+				.build();
 
 		VaultTokenResponse tokenResponse = tokenOperations.create(tokenRequest);
 		VaultTokenResponse renew = tokenOperations.renew(tokenResponse.getToken());
@@ -132,8 +140,8 @@ public class VaultTokenTemplateIntegrationTests extends IntegrationTestSupport {
 		VaultResponseEntity<String> response = lookupSelf(tokenResponse);
 
 		assertThat(response.getStatusCode()).isIn(
-				/* <= Vault 0.6.0 */HttpStatus.BAD_REQUEST,
-				/* >= Vault 0.6.1 */HttpStatus.FORBIDDEN);
+		/* <= Vault 0.6.0 */HttpStatus.BAD_REQUEST,
+		/* >= Vault 0.6.1 */HttpStatus.FORBIDDEN);
 		assertThat(response.getMessage()).isEqualTo("permission denied");
 	}
 

spring-vault-core/src/test/java/org/springframework/vault/util/PrepareVault.java

@@ -18,6 +18,7 @@ package org.springframework.vault.util;
 import java.util.Collections;
 
 import org.springframework.util.Assert;
+import org.springframework.util.StringUtils;
 import org.springframework.vault.client.VaultClient;
 import org.springframework.vault.core.VaultOperations;
 import org.springframework.vault.core.VaultSysOperations;
@@ -26,6 +27,7 @@ import org.springframework.vault.support.VaultInitializationResponse;
 import org.springframework.vault.support.VaultMount;
 import org.springframework.vault.support.VaultToken;
 import org.springframework.vault.support.VaultTokenRequest;
+import org.springframework.vault.support.VaultTokenRequest.VaultTokenRequestBuilder;
 import org.springframework.vault.support.VaultTokenResponse;
 import org.springframework.vault.support.VaultUnsealStatus;
 
@@ -85,15 +87,14 @@ public class PrepareVault {
 	 */
 	public VaultToken createToken(String tokenId, String policy) {
 
-		VaultTokenRequest tokenRequest = new VaultTokenRequest();
+		VaultTokenRequestBuilder builder = VaultTokenRequest.builder().id(tokenId);
 
-		tokenRequest.setId(tokenId);
-		if (policy != null) {
-			tokenRequest.setPolicies(Collections.singletonList(policy));
+		if(StringUtils.hasText(policy)){
+			builder.withPolicy(policy);
 		}
 
 		VaultTokenResponse vaultTokenResponse = vaultOperations.opsForToken().create(
-				tokenRequest);
+				builder.build());
 		return vaultTokenResponse.getToken();
 	}