Spring/spring-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Polishing

Browse Source 
Move AppRole-related utility methods to AppRoleAuthentication. Create dedicated methods for role-id and secret-id path computations.

Tweak docs.

Original pull request: gh-533.
This commit is contained in:
Mark Paluch
2020-01-31 11:16:38 +01:00
parent ac38b83b4c
commit f13bfdcf13
3 changed files with 42 additions and 28 deletions
Download Patch File Download Diff File Expand all files Collapse all files

36
spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java
View File

@@ -46,6 +46,7 @@ import org.springframework.web.client.RestOperations;
import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.get;
import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.method;
import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.post;
import static org.springframework.vault.authentication.AuthenticationUtil.getLoginPath;
/**
* AppRole implementation of {@link ClientAuthentication}. RoleId and SecretId (optional)
@@ -105,7 +106,7 @@ public class AppRoleAuthentication
SecretId secretId = options.getSecretId();
return getAuthenticationSteps(options, roleId, secretId)
.login(AuthenticationUtil.getLoginPath(options.getPath()));
.login(getLoginPath(options.getPath()));
}
private static Node<Map<String, String>> getAuthenticationSteps(
@@ -130,9 +131,8 @@ public class AppRoleAuthentication
HttpHeaders headers = createHttpHeaders(((Pull) roleId).getInitialToken());
return AuthenticationSteps
.fromHttpRequest(get(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id",
options.getAppRole()).with(headers)
.as(VaultResponse.class))
.fromHttpRequest(get(getRoleIdIdPath(options)).with(headers)
.as(VaultResponse.class))
.map(vaultResponse -> (String) vaultResponse.getRequiredData()
.get("role_id"));
}
@@ -158,9 +158,8 @@ public class AppRoleAuthentication
HttpHeaders headers = createHttpHeaders(((Pull) secretId).getInitialToken());
return AuthenticationSteps
.fromHttpRequest(post(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id",
options.getAppRole()).with(headers)
.as(VaultResponse.class))
.fromHttpRequest(post(getSecretIdPath(options)).with(headers)
.as(VaultResponse.class))
.map(vaultResponse -> (String) vaultResponse.getRequiredData()
.get("secret_id"));
}
@@ -203,8 +202,8 @@ public class AppRoleAuthentication
options.getSecretId());
try {
VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()),
login, VaultResponse.class);
VaultResponse response = restOperations.postForObject(
getLoginPath(options.getPath()), login, VaultResponse.class);
Assert.state(response != null && response.getAuth() != null,
"Auth field must not be null");
@@ -231,9 +230,8 @@ public class AppRoleAuthentication
try {
ResponseEntity<VaultResponse> entity = restOperations.exchange(
AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", HttpMethod.GET,
createHttpEntity(token), VaultResponse.class,
options.getAppRole());
getRoleIdIdPath(options), HttpMethod.GET, createHttpEntity(token),
VaultResponse.class);
return (String) entity.getBody().getRequiredData().get("role_id");
}
catch (HttpStatusCodeException e) {
@@ -283,8 +281,8 @@ public class AppRoleAuthentication
try {
VaultResponse response = restOperations.postForObject(
AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", createHttpEntity(token),
VaultResponse.class, options.getAppRole());
getSecretIdPath(options), createHttpEntity(token),
VaultResponse.class);
return (String) response.getRequiredData().get("secret_id");
}
catch (HttpStatusCodeException e) {
@@ -361,4 +359,14 @@ public class AppRoleAuthentication
return login;
}
private static String getSecretIdPath(AppRoleAuthenticationOptions options) {
return String.format("auth/%s/role/%s/secret-id", options.getPath(),
options.getAppRole());
}
private static String getRoleIdIdPath(AppRoleAuthenticationOptions options) {
return String.format("auth/%s/role/%s/role-id", options.getPath(),
options.getAppRole());
}
}

21
spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java
View File

@@ -2,16 +2,21 @@ package org.springframework.vault.authentication;
/**
* Utility class to have all the common path templates together.
* @author alapatsin
*
* @author Oleg Lopatin
*/
abstract class AuthenticationUtil {
static String getAuthRolePath(String path) {
return String.format("auth/%s/role/", path);
/**
* Returns the login path for a {@code authMount}.
*
* @param authMount
* @return
*/
static String getLoginPath(String authMount) {
return String.format("auth/%s/login", authMount);
}
private AuthenticationUtil() {
}
static String getLoginPath(String path) {
return String.format("auth/%s/login", path);
}
}

13
src/main/asciidoc/reference/authentication.adoc
View File

@@ -813,13 +813,14 @@ AuthenticationSteps.fromSupplier( <1>
() -> getAppRoleLogin(options.getRoleId(), options.getSecretId())) <2>
.login(AuthenticationUtil.getLoginPath(options.getPath())); <3>
.login("auth/{mount}/login", options.getPath()); <3>
----
<1> Start declaring `AuthenticationSteps` accepting a `Supplier<T>`. The state
object type depends on the `Supplier` response type which can be mapped in a later step.
<2> The actual `Supplier` implementation. Creating a `Map` in this case.
<3> Perform a Vault login by posting the state object (`Map`) to a Vault endpoint
for Vault token creation.
<1> Start declaring `AuthenticationSteps` accepting a `Supplier<T>`.
The state object type depends on the `Supplier` response type which can be mapped in a later step.
<2> The actual `Supplier` implementation.
Creating a `Map` in this case.
<3> Perform a Vault login by posting the state object (`Map`) to a Vault endpoint for Vault token creation.
Note that template variables are subject to URL escaping.
====
Authentication flows require an executor to perform the actual login. We provide two executors