diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java index c66a3671..2769de54 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppIdAuthentication.java @@ -82,7 +82,7 @@ public class AppIdAuthentication return AuthenticationSteps .fromSupplier(() -> getAppIdLogin(options.getAppId(), options.getUserIdMechanism().createUserId())) // - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -101,8 +101,8 @@ public class AppIdAuthentication options.getUserIdMechanism().createUserId()); try { - VaultResponse response = restOperations.postForObject("auth/{mount}/login", - login, VaultResponse.class, options.getPath()); + VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()), + login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java index 3046d4ba..c061b39e 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java @@ -35,6 +35,7 @@ import org.springframework.vault.authentication.AppRoleTokens.Provided; import org.springframework.vault.authentication.AppRoleTokens.Pull; import org.springframework.vault.authentication.AppRoleTokens.Wrapped; import org.springframework.vault.authentication.AuthenticationSteps.Node; +import org.springframework.vault.client.VaultHttpHeaders; import org.springframework.vault.client.VaultResponses; import org.springframework.vault.support.VaultResponse; import org.springframework.vault.support.VaultToken; @@ -104,7 +105,7 @@ public class AppRoleAuthentication SecretId secretId = options.getSecretId(); return getAuthenticationSteps(options, roleId, secretId) - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } private static Node> getAuthenticationSteps( @@ -129,8 +130,8 @@ public class AppRoleAuthentication HttpHeaders headers = createHttpHeaders(((Pull) roleId).getInitialToken()); return AuthenticationSteps - .fromHttpRequest(get("auth/{mount}/role/{role}/role-id", - options.getPath(), options.getAppRole()).with(headers) + .fromHttpRequest(get(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", + options.getAppRole()).with(headers) .as(VaultResponse.class)) .map(vaultResponse -> (String) vaultResponse.getRequiredData() .get("role_id")); @@ -157,8 +158,8 @@ public class AppRoleAuthentication HttpHeaders headers = createHttpHeaders(((Pull) secretId).getInitialToken()); return AuthenticationSteps - .fromHttpRequest(post("auth/{mount}/role/{role}/secret-id", - options.getPath(), options.getAppRole()).with(headers) + .fromHttpRequest(post(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", + options.getAppRole()).with(headers) .as(VaultResponse.class)) .map(vaultResponse -> (String) vaultResponse.getRequiredData() .get("secret_id")); @@ -202,8 +203,8 @@ public class AppRoleAuthentication options.getSecretId()); try { - VaultResponse response = restOperations.postForObject("auth/{mount}/login", - login, VaultResponse.class, options.getPath()); + VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()), + login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); @@ -230,8 +231,8 @@ public class AppRoleAuthentication try { ResponseEntity entity = restOperations.exchange( - "auth/{mount}/role/{role}/role-id", HttpMethod.GET, - createHttpEntity(token), VaultResponse.class, options.getPath(), + AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", HttpMethod.GET, + createHttpEntity(token), VaultResponse.class, options.getAppRole()); return (String) entity.getBody().getRequiredData().get("role_id"); } @@ -282,8 +283,8 @@ public class AppRoleAuthentication try { VaultResponse response = restOperations.postForObject( - "auth/{mount}/role/{role}/secret-id", createHttpEntity(token), - VaultResponse.class, options.getPath(), options.getAppRole()); + AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", createHttpEntity(token), + VaultResponse.class, options.getAppRole()); return (String) response.getRequiredData().get("secret_id"); } catch (HttpStatusCodeException e) { @@ -325,12 +326,12 @@ public class AppRoleAuthentication private static HttpHeaders createHttpHeaders(VaultToken token) { HttpHeaders headers = new HttpHeaders(); - headers.set("X-Vault-Token", token.getToken()); + headers.set(VaultHttpHeaders.VAULT_TOKEN, token.getToken()); return headers; } - private static HttpEntity createHttpEntity(VaultToken token) { + private static HttpEntity createHttpEntity(VaultToken token) { return new HttpEntity(null, createHttpHeaders(token)); } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationSteps.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationSteps.java index 737493ed..c9d8b459 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationSteps.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationSteps.java @@ -53,7 +53,7 @@ import org.springframework.vault.support.VaultToken; * login.put("pkcs7", pkcs7); * * return login; - * }).login("auth/{mount}/login", "aws"); + * }).login(AuthenticationUtil.getLoginPath(options.getPath())); * * *

diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java new file mode 100644 index 00000000..0659e7ff --- /dev/null +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java @@ -0,0 +1,17 @@ +package org.springframework.vault.authentication; + +/** + * Utility class to have all the common path templates together. + * @author alapatsin + * + */ +abstract class AuthenticationUtil { + + static String getAuthRolePath(String path) { + return String.format("auth/%s/role/", path); + } + + static String getLoginPath(String path) { + return String.format("auth/%s/login", path); + } +} diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsEc2Authentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsEc2Authentication.java index 105bc0bb..e4fc1c17 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsEc2Authentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsEc2Authentication.java @@ -138,7 +138,7 @@ public class AwsEc2Authentication login.put("pkcs7", pkcs7); return login; - }).login("auth/{mount}/login", options.getPath()); + }).login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -159,7 +159,7 @@ public class AwsEc2Authentication try { VaultResponse response = this.vaultRestOperations.postForObject( - "auth/{mount}/login", login, VaultResponse.class, options.getPath()); + AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsIamAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsIamAuthentication.java index 91b748be..3c0d1831 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsIamAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AwsIamAuthentication.java @@ -125,7 +125,7 @@ public class AwsIamAuthentication return AuthenticationSteps .fromSupplier(() -> createRequestBody(options, credentials)) // - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -147,7 +147,7 @@ public class AwsIamAuthentication try { VaultResponse response = this.vaultRestOperations.postForObject( - "auth/{mount}/login", login, VaultResponse.class, options.getPath()); + AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java index f2d08942..e9580d24 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AzureMsiAuthentication.java @@ -147,7 +147,7 @@ public class AzureMsiAuthentication implements ClientAuthentication { return environmentSteps.zipWith(msiToken) .map(tuple -> getAzureLogin(options.getRole(), tuple.getLeft(), tuple.getRight())) // - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -155,7 +155,6 @@ public class AzureMsiAuthentication implements ClientAuthentication { return createTokenUsingAzureMsiCompute(); } - @SuppressWarnings("unchecked") private VaultToken createTokenUsingAzureMsiCompute() { Map login = getAzureLogin(options.getRole(), getVmEnvironment(), @@ -164,7 +163,7 @@ public class AzureMsiAuthentication implements ClientAuthentication { try { VaultResponse response = this.vaultRestOperations.postForObject( - "auth/{mount}/login", login, VaultResponse.class, options.getPath()); + AuthenticationUtil.getLoginPath(options.getPath()), login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); @@ -193,7 +192,6 @@ public class AzureMsiAuthentication implements ClientAuthentication { return loginBody; } - @SuppressWarnings("unchecked") private String getAccessToken() { ResponseEntity response = this.azureMetadataRestOperations.exchange( diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java index bd808ef1..1115220c 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/ClientCertificateAuthentication.java @@ -36,6 +36,8 @@ import static org.springframework.vault.authentication.AuthenticationSteps.HttpR public class ClientCertificateAuthentication implements ClientAuthentication, AuthenticationStepsFactory { + private static final String CERT = "cert"; + private static final Log logger = LogFactory .getLog(ClientCertificateAuthentication.class); @@ -60,12 +62,12 @@ public class ClientCertificateAuthentication * @since 2.0 */ public static AuthenticationSteps createAuthenticationSteps() { - return AuthenticationSteps.just(post("auth/cert/login").as(VaultResponse.class)); + return AuthenticationSteps.just(post(AuthenticationUtil.getLoginPath(CERT)).as(VaultResponse.class)); } @Override public VaultToken login() { - return createTokenUsingTlsCertAuthentication("cert"); + return createTokenUsingTlsCertAuthentication(); } @Override @@ -73,11 +75,11 @@ public class ClientCertificateAuthentication return createAuthenticationSteps(); } - private VaultToken createTokenUsingTlsCertAuthentication(String path) { + private VaultToken createTokenUsingTlsCertAuthentication() { try { - VaultResponse response = restOperations.postForObject("auth/{mount}/login", - Collections.emptyMap(), VaultResponse.class, path); + VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(CERT), + Collections.emptyMap(), VaultResponse.class); Assert.state(response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpComputeAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpComputeAuthentication.java index bb4f2e8f..a16541dd 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpComputeAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpComputeAuthentication.java @@ -118,7 +118,7 @@ public class GcpComputeAuthentication extends GcpJwtAuthenticationSupport return AuthenticationSteps.fromHttpRequest(jwtRequest) // .map(jwt -> createRequestBody(options.getRole(), jwt)) - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java index 59d3b457..9240c717 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpIamAuthentication.java @@ -110,7 +110,6 @@ public class GcpIamAuthentication extends GcpJwtAuthenticationSupport this.credential = options.getCredentialSupplier().get(); } - @SuppressWarnings("unchecked") @Override public VaultToken login() throws VaultException { diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpJwtAuthenticationSupport.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpJwtAuthenticationSupport.java index 73117c33..6d62c2a5 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpJwtAuthenticationSupport.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/GcpJwtAuthenticationSupport.java @@ -64,7 +64,7 @@ public abstract class GcpJwtAuthenticationSupport { try { VaultResponse response = this.restOperations.postForObject( - "auth/{mount}/login", login, VaultResponse.class, path); + AuthenticationUtil.getLoginPath(path), login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java index 29745913..eed8df2d 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/KubernetesAuthentication.java @@ -82,8 +82,8 @@ public class KubernetesAuthentication String token = options.getJwtSupplier().get(); return AuthenticationSteps - .fromSupplier(() -> getKubernetesLogin(options.getRole(), token)) // - .login("auth/{mount}/login", options.getPath()); + .fromSupplier(() -> getKubernetesLogin(options.getRole(), token)) + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -93,8 +93,8 @@ public class KubernetesAuthentication options.getJwtSupplier().get()); try { - VaultResponse response = restOperations.postForObject("auth/{mount}/login", - login, VaultResponse.class, options.getPath()); + VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()), + login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java index 4b1b0007..61bcd94f 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/PcfAuthentication.java @@ -101,7 +101,7 @@ public class PcfAuthentication return AuthenticationSteps .fromSupplier(() -> getPcfLogin(options.getRole(), options.getClock(), instanceCert, instanceKey)) // - .login("auth/{mount}/login", options.getPath()); + .login(AuthenticationUtil.getLoginPath(options.getPath())); } @Override @@ -112,8 +112,8 @@ public class PcfAuthentication options.getInstanceKeySupplier().get()); try { - VaultResponse response = restOperations.postForObject("auth/{mount}/login", - login, VaultResponse.class, options.getPath()); + VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()), + login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); diff --git a/src/main/asciidoc/reference/authentication.adoc b/src/main/asciidoc/reference/authentication.adoc index 14022015..c626000a 100644 --- a/src/main/asciidoc/reference/authentication.adoc +++ b/src/main/asciidoc/reference/authentication.adoc @@ -813,7 +813,7 @@ AuthenticationSteps.fromSupplier( <1> () -> getAppRoleLogin(options.getRoleId(), options.getSecretId())) <2> - .login("auth/{mount}/login", options.getPath()); <3> + .login(AuthenticationUtil.getLoginPath(options.getPath())); <3> ---- <1> Start declaring `AuthenticationSteps` accepting a `Supplier`. The state object type depends on the `Supplier` response type which can be mapped in a later step.