From f13bfdcf131f767bc62f8a7c6ab0e740000c6e11 Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Fri, 31 Jan 2020 11:16:38 +0100 Subject: [PATCH] Polishing Move AppRole-related utility methods to AppRoleAuthentication. Create dedicated methods for role-id and secret-id path computations. Tweak docs. Original pull request: gh-533. --- .../authentication/AppRoleAuthentication.java | 36 +++++++++++-------- .../authentication/AuthenticationUtil.java | 21 ++++++----- .../asciidoc/reference/authentication.adoc | 13 +++---- 3 files changed, 42 insertions(+), 28 deletions(-) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java index c061b39e..257f07f0 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AppRoleAuthentication.java @@ -46,6 +46,7 @@ import org.springframework.web.client.RestOperations; import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.get; import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.method; import static org.springframework.vault.authentication.AuthenticationSteps.HttpRequestBuilder.post; +import static org.springframework.vault.authentication.AuthenticationUtil.getLoginPath; /** * AppRole implementation of {@link ClientAuthentication}. RoleId and SecretId (optional) @@ -105,7 +106,7 @@ public class AppRoleAuthentication SecretId secretId = options.getSecretId(); return getAuthenticationSteps(options, roleId, secretId) - .login(AuthenticationUtil.getLoginPath(options.getPath())); + .login(getLoginPath(options.getPath())); } private static Node> getAuthenticationSteps( @@ -130,9 +131,8 @@ public class AppRoleAuthentication HttpHeaders headers = createHttpHeaders(((Pull) roleId).getInitialToken()); return AuthenticationSteps - .fromHttpRequest(get(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", - options.getAppRole()).with(headers) - .as(VaultResponse.class)) + .fromHttpRequest(get(getRoleIdIdPath(options)).with(headers) + .as(VaultResponse.class)) .map(vaultResponse -> (String) vaultResponse.getRequiredData() .get("role_id")); } @@ -158,9 +158,8 @@ public class AppRoleAuthentication HttpHeaders headers = createHttpHeaders(((Pull) secretId).getInitialToken()); return AuthenticationSteps - .fromHttpRequest(post(AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", - options.getAppRole()).with(headers) - .as(VaultResponse.class)) + .fromHttpRequest(post(getSecretIdPath(options)).with(headers) + .as(VaultResponse.class)) .map(vaultResponse -> (String) vaultResponse.getRequiredData() .get("secret_id")); } @@ -203,8 +202,8 @@ public class AppRoleAuthentication options.getSecretId()); try { - VaultResponse response = restOperations.postForObject(AuthenticationUtil.getLoginPath(options.getPath()), - login, VaultResponse.class); + VaultResponse response = restOperations.postForObject( + getLoginPath(options.getPath()), login, VaultResponse.class); Assert.state(response != null && response.getAuth() != null, "Auth field must not be null"); @@ -231,9 +230,8 @@ public class AppRoleAuthentication try { ResponseEntity entity = restOperations.exchange( - AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/role-id", HttpMethod.GET, - createHttpEntity(token), VaultResponse.class, - options.getAppRole()); + getRoleIdIdPath(options), HttpMethod.GET, createHttpEntity(token), + VaultResponse.class); return (String) entity.getBody().getRequiredData().get("role_id"); } catch (HttpStatusCodeException e) { @@ -283,8 +281,8 @@ public class AppRoleAuthentication try { VaultResponse response = restOperations.postForObject( - AuthenticationUtil.getAuthRolePath(options.getPath()) + "{role}/secret-id", createHttpEntity(token), - VaultResponse.class, options.getAppRole()); + getSecretIdPath(options), createHttpEntity(token), + VaultResponse.class); return (String) response.getRequiredData().get("secret_id"); } catch (HttpStatusCodeException e) { @@ -361,4 +359,14 @@ public class AppRoleAuthentication return login; } + + private static String getSecretIdPath(AppRoleAuthenticationOptions options) { + return String.format("auth/%s/role/%s/secret-id", options.getPath(), + options.getAppRole()); + } + + private static String getRoleIdIdPath(AppRoleAuthenticationOptions options) { + return String.format("auth/%s/role/%s/role-id", options.getPath(), + options.getAppRole()); + } } diff --git a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java index 0659e7ff..a0099359 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/authentication/AuthenticationUtil.java @@ -2,16 +2,21 @@ package org.springframework.vault.authentication; /** * Utility class to have all the common path templates together. - * @author alapatsin * + * @author Oleg Lopatin */ abstract class AuthenticationUtil { - - static String getAuthRolePath(String path) { - return String.format("auth/%s/role/", path); + + /** + * Returns the login path for a {@code authMount}. + * + * @param authMount + * @return + */ + static String getLoginPath(String authMount) { + return String.format("auth/%s/login", authMount); + } + + private AuthenticationUtil() { } - - static String getLoginPath(String path) { - return String.format("auth/%s/login", path); - } } diff --git a/src/main/asciidoc/reference/authentication.adoc b/src/main/asciidoc/reference/authentication.adoc index c626000a..626d62f6 100644 --- a/src/main/asciidoc/reference/authentication.adoc +++ b/src/main/asciidoc/reference/authentication.adoc @@ -813,13 +813,14 @@ AuthenticationSteps.fromSupplier( <1> () -> getAppRoleLogin(options.getRoleId(), options.getSecretId())) <2> - .login(AuthenticationUtil.getLoginPath(options.getPath())); <3> + .login("auth/{mount}/login", options.getPath()); <3> ---- -<1> Start declaring `AuthenticationSteps` accepting a `Supplier`. The state -object type depends on the `Supplier` response type which can be mapped in a later step. -<2> The actual `Supplier` implementation. Creating a `Map` in this case. -<3> Perform a Vault login by posting the state object (`Map`) to a Vault endpoint -for Vault token creation. +<1> Start declaring `AuthenticationSteps` accepting a `Supplier`. +The state object type depends on the `Supplier` response type which can be mapped in a later step. +<2> The actual `Supplier` implementation. +Creating a `Map` in this case. +<3> Perform a Vault login by posting the state object (`Map`) to a Vault endpoint for Vault token creation. +Note that template variables are subject to URL escaping. ==== Authentication flows require an executor to perform the actual login. We provide two executors