Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Avoid auth mount path escaping

Browse Source 
If one wants it being escaped, it could be done in advance in the configuration.

Original pull request: gh-533.
Closes gh-532.
This commit is contained in:
Oleg Lopatin
2020-01-29 14:55:41 -08:00
committed by Mark Paluch
parent 71e6351256
commit ac38b83b4c
14 changed files with 58 additions and 41 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java
View File

@@ -82,7 +82,7 @@ public class AppIdAuthentication
return AuthenticationSteps
.fromSupplier(() -> getAppIdLogin(options.getAppId(),
options.getUserIdMechanism().createUserId())) //
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -101,8 +101,8 @@ public class AppIdAuthentication
options.getUserIdMechanism().createUserId());
try {
VaultResponse response = restOperations.postForObject("auth/{mount}/login",
login, VaultResponse.class, options.getPath());
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()),
login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

27
spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java
View File

@@ -35,6 +35,7 @@ import org.springframework.vault.authentication.AppRoleTokens.Provided;
import org.springframework.vault.authentication.AppRoleTokens.Pull;
import org.springframework.vault.authentication.AppRoleTokens.Wrapped;
import org.springframework.vault.authentication.AuthenticationSteps.Node;
import org.springframework.vault.client.VaultHttpHeaders;
import org.springframework.vault.client.VaultResponses;
import org.springframework.vault.support.VaultResponse;
import org.springframework.vault.support.VaultToken;
@@ -104,7 +105,7 @@ public class AppRoleAuthentication
SecretId secretId = options.getSecretId();
return getAuthenticationSteps(options, roleId, secretId)
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
private static Node<Map<String, String>> getAuthenticationSteps(
@@ -129,8 +130,8 @@ public class AppRoleAuthentication
HttpHeaders headers = createHttpHeaders(((Pull) roleId).getInitialToken());
return AuthenticationSteps
.fromHttpRequest(get("auth/{mount}/role/{role}/role-id",
options.getPath(), options.getAppRole()).with(headers)
.fromHttpRequest(get(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id",
options.getAppRole()).with(headers)
.as(VaultResponse.class))
.map(vaultResponse -> (String) vaultResponse.getRequiredData()
.get("role_id"));
@@ -157,8 +158,8 @@ public class AppRoleAuthentication
HttpHeaders headers = createHttpHeaders(((Pull) secretId).getInitialToken());
return AuthenticationSteps
.fromHttpRequest(post("auth/{mount}/role/{role}/secret-id",
options.getPath(), options.getAppRole()).with(headers)
.fromHttpRequest(post(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id",
options.getAppRole()).with(headers)
.as(VaultResponse.class))
.map(vaultResponse -> (String) vaultResponse.getRequiredData()
.get("secret_id"));
@@ -202,8 +203,8 @@ public class AppRoleAuthentication
options.getSecretId());
try {
VaultResponse response = restOperations.postForObject("auth/{mount}/login",
login, VaultResponse.class, options.getPath());
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()),
login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");
@@ -230,8 +231,8 @@ public class AppRoleAuthentication
try {
ResponseEntity<VaultResponse> entity = restOperations.exchange(
"auth/{mount}/role/{role}/role-id", HttpMethod.GET,
createHttpEntity(token), VaultResponse.class, options.getPath(),
AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", HttpMethod.GET,
createHttpEntity(token), VaultResponse.class,
options.getAppRole());
return (String) entity.getBody().getRequiredData().get("role_id");
}
@@ -282,8 +283,8 @@ public class AppRoleAuthentication
try {
VaultResponse response = restOperations.postForObject(
"auth/{mount}/role/{role}/secret-id", createHttpEntity(token),
VaultResponse.class, options.getPath(), options.getAppRole());
AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", createHttpEntity(token),
VaultResponse.class, options.getAppRole());
return (String) response.getRequiredData().get("secret_id");
}
catch (HttpStatusCodeException e) {
@@ -325,12 +326,12 @@ public class AppRoleAuthentication
private static HttpHeaders createHttpHeaders(VaultToken token) {
HttpHeaders headers = new HttpHeaders();
headers.set("X-Vault-Token", token.getToken());
headers.set(VaultHttpHeaders.VAULT_TOKEN, token.getToken());
return headers;
}
private static HttpEntity createHttpEntity(VaultToken token) {
private static HttpEntity<String> createHttpEntity(VaultToken token) {
return new HttpEntity<String>(null, createHttpHeaders(token));
}

2
spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationSteps.java
View File

@@ -53,7 +53,7 @@ import org.springframework.vault.support.VaultToken;
* login.put(&quot;pkcs7&quot;, pkcs7);
*
* return login;
* }).login(&quot;auth/{mount}/login&quot;, &quot;aws&quot;);
* }).login(AuthenticationUtil.getLoginPath(options.getPath()));
* </pre>
*
* <p>

17
spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java Normal file
View File

@@ -0,0 +1,17 @@
package org.springframework.vault.authentication;
/**
* Utility class to have all the common path templates together.
* @author alapatsin
*
*/
abstract class AuthenticationUtil {
static String getAuthRolePath(String path) {
return String.format("auth/%s/role/", path);
}
static String getLoginPath(String path) {
return String.format("auth/%s/login", path);
}
}

4
spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsEc2Authentication.java
View File

@@ -138,7 +138,7 @@ public class AwsEc2Authentication
login.put("pkcs7", pkcs7);
return login;
}).login("auth/{mount}/login", options.getPath());
}).login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -159,7 +159,7 @@ public class AwsEc2Authentication
try {
VaultResponse response = this.vaultRestOperations.postForObject(
"auth/{mount}/login", login, VaultResponse.class, options.getPath());
AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

4
spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsIamAuthentication.java
View File

@@ -125,7 +125,7 @@ public class AwsIamAuthentication
return AuthenticationSteps
.fromSupplier(() -> createRequestBody(options, credentials)) //
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -147,7 +147,7 @@ public class AwsIamAuthentication
try {
VaultResponse response = this.vaultRestOperations.postForObject(
"auth/{mount}/login", login, VaultResponse.class, options.getPath());
AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

6
spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java
View File

@@ -147,7 +147,7 @@ public class AzureMsiAuthentication implements ClientAuthentication {
return environmentSteps.zipWith(msiToken)
.map(tuple -> getAzureLogin(options.getRole(), tuple.getLeft(),
tuple.getRight())) //
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -155,7 +155,6 @@ public class AzureMsiAuthentication implements ClientAuthentication {
return createTokenUsingAzureMsiCompute();
}
@SuppressWarnings("unchecked")
private VaultToken createTokenUsingAzureMsiCompute() {
Map<String, String> login = getAzureLogin(options.getRole(), getVmEnvironment(),
@@ -164,7 +163,7 @@ public class AzureMsiAuthentication implements ClientAuthentication {
try {
VaultResponse response = this.vaultRestOperations.postForObject(
"auth/{mount}/login", login, VaultResponse.class, options.getPath());
AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");
@@ -193,7 +192,6 @@ public class AzureMsiAuthentication implements ClientAuthentication {
return loginBody;
}
@SuppressWarnings("unchecked")
private String getAccessToken() {
ResponseEntity<Map> response = this.azureMetadataRestOperations.exchange(

12
spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java
View File

@@ -36,6 +36,8 @@ import static org.springframework.vault.authentication.AuthenticationSteps.HttpR
public class ClientCertificateAuthentication
implements ClientAuthentication, AuthenticationStepsFactory {
private static final String CERT = "cert";
private static final Log logger = LogFactory
.getLog(ClientCertificateAuthentication.class);
@@ -60,12 +62,12 @@ public class ClientCertificateAuthentication
* @since 2.0
*/
public static AuthenticationSteps createAuthenticationSteps() {
return AuthenticationSteps.just(post("auth/cert/login").as(VaultResponse.class));
return AuthenticationSteps.just(post(AuthenticationUtil.getLoginPath(CERT)).as(VaultResponse.class));
}
@Override
public VaultToken login() {
return createTokenUsingTlsCertAuthentication("cert");
return createTokenUsingTlsCertAuthentication();
}
@Override
@@ -73,11 +75,11 @@ public class ClientCertificateAuthentication
return createAuthenticationSteps();
}
private VaultToken createTokenUsingTlsCertAuthentication(String path) {
private VaultToken createTokenUsingTlsCertAuthentication() {
try {
VaultResponse response = restOperations.postForObject("auth/{mount}/login",
Collections.emptyMap(), VaultResponse.class, path);
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(CERT),
Collections.emptyMap(), VaultResponse.class);
Assert.state(response.getAuth() != null, "Auth field must not be null");

2
spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpComputeAuthentication.java
View File

@@ -118,7 +118,7 @@ public class GcpComputeAuthentication extends GcpJwtAuthenticationSupport
return AuthenticationSteps.fromHttpRequest(jwtRequest)
//
.map(jwt -> createRequestBody(options.getRole(), jwt))
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override

1
spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java
View File

@@ -110,7 +110,6 @@ public class GcpIamAuthentication extends GcpJwtAuthenticationSupport
this.credential = options.getCredentialSupplier().get();
}
@SuppressWarnings("unchecked")
@Override
public VaultToken login() throws VaultException {

2
spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpJwtAuthenticationSupport.java
View File

@@ -64,7 +64,7 @@ public abstract class GcpJwtAuthenticationSupport {
try {
VaultResponse response = this.restOperations.postForObject(
"auth/{mount}/login", login, VaultResponse.class, path);
AuthenticationUtil.getLoginPath(path), login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

8
spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java
View File

@@ -82,8 +82,8 @@ public class KubernetesAuthentication
String token = options.getJwtSupplier().get();
return AuthenticationSteps
.fromSupplier(() -> getKubernetesLogin(options.getRole(), token)) //
.login("auth/{mount}/login", options.getPath());
.fromSupplier(() -> getKubernetesLogin(options.getRole(), token))
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -93,8 +93,8 @@ public class KubernetesAuthentication
options.getJwtSupplier().get());
try {
VaultResponse response = restOperations.postForObject("auth/{mount}/login",
login, VaultResponse.class, options.getPath());
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()),
login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

6
spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java
View File

@@ -101,7 +101,7 @@ public class PcfAuthentication
return AuthenticationSteps
.fromSupplier(() -> getPcfLogin(options.getRole(), options.getClock(),
instanceCert, instanceKey)) //
.login("auth/{mount}/login", options.getPath());
.login(AuthenticationUtil.getLoginPath(options.getPath()));
}
@Override
@@ -112,8 +112,8 @@ public class PcfAuthentication
options.getInstanceKeySupplier().get());
try {
VaultResponse response = restOperations.postForObject("auth/{mount}/login",
login, VaultResponse.class, options.getPath());
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()),
login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");

2
src/main/asciidoc/reference/authentication.adoc
View File

@@ -813,7 +813,7 @@ AuthenticationSteps.fromSupplier( <1>
() -> getAppRoleLogin(options.getRoleId(), options.getSecretId())) <2>
.login("auth/{mount}/login", options.getPath()); <3>
.login(AuthenticationUtil.getLoginPath(options.getPath())); <3>
----
<1> Start declaring `AuthenticationSteps` accepting a `Supplier<T>`. The state
object type depends on the `Supplier` response type which can be mapped in a later step.