From fecc8b5d9cb3d3e2f44e7cced7c5dc201a40f2ab Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Fri, 26 Oct 2018 11:17:34 +0200 Subject: [PATCH] Fix secret rotation on expired leases. Handling for expired leases now considers the appropriate exception type. See gh-319 gh-321. --- .../vault/core/lease/SecretLeaseContainer.java | 10 ++++++++++ .../lease/SecretLeaseContainerUnitTests.java | 18 ++++++++++++++++++ 2 files changed, 28 insertions(+) diff --git a/spring-vault-core/src/main/java/org/springframework/vault/core/lease/SecretLeaseContainer.java b/spring-vault-core/src/main/java/org/springframework/vault/core/lease/SecretLeaseContainer.java index 8302f7e6..83680be1 100644 --- a/spring-vault-core/src/main/java/org/springframework/vault/core/lease/SecretLeaseContainer.java +++ b/spring-vault-core/src/main/java/org/springframework/vault/core/lease/SecretLeaseContainer.java @@ -517,6 +517,16 @@ public class SecretLeaseContainer extends SecretLeaseEventPublisher implements return renewed; } + catch (VaultException e) { + + // Workaround as there is no HttpStatusCodeException attached. + if (e.getMessage().contains("Status 400")) { + onLeaseExpired(requestedSecret, lease); + } + + onError(requestedSecret, lease, + new VaultException(String.format("Cannot renew lease: %s", e))); + } catch (HttpStatusCodeException e) { if (e.getStatusCode() == HttpStatus.BAD_REQUEST) { diff --git a/spring-vault-core/src/test/java/org/springframework/vault/core/lease/SecretLeaseContainerUnitTests.java b/spring-vault-core/src/test/java/org/springframework/vault/core/lease/SecretLeaseContainerUnitTests.java index 0279d2b5..b878d560 100644 --- a/spring-vault-core/src/test/java/org/springframework/vault/core/lease/SecretLeaseContainerUnitTests.java +++ b/spring-vault-core/src/test/java/org/springframework/vault/core/lease/SecretLeaseContainerUnitTests.java @@ -37,6 +37,7 @@ import org.springframework.http.ResponseEntity; import org.springframework.scheduling.TaskScheduler; import org.springframework.scheduling.Trigger; import org.springframework.vault.VaultException; +import org.springframework.vault.client.VaultResponses; import org.springframework.vault.core.RestOperationsCallback; import org.springframework.vault.core.VaultOperations; import org.springframework.vault.core.lease.domain.Lease; @@ -487,6 +488,23 @@ public class SecretLeaseContainerUnitTests { any(AfterSecretLeaseRevocationEvent.class)); } + @Test + public void expiredLeaseShouldRenew() { + + prepareRenewal(); + + VaultException exception = VaultResponses + .buildException(new HttpClientErrorException(HttpStatus.BAD_REQUEST)); + + when(vaultOperations.doWithSession(any(RestOperationsCallback.class))).thenThrow( + exception); + + secretLeaseContainer.doRenewLease(requestedSecret, Lease.of("foo", 1, true)); + + verify(leaseListenerAdapter).onLeaseEvent(any(SecretLeaseExpiredEvent.class)); + verify(vaultOperations).doWithSession(any(RestOperationsCallback.class)); + } + @Test public void shouldNotRevokeSecretsWithoutLease() throws Exception {