Fix docs
This commit is contained in:
Dave Syer
@@ -1,2 +0,0 @@
|
||||
include::intro.adoc[]
|
||||
|
||||
@@ -1,46 +0,0 @@
|
||||
#!/bin/bash -x
|
||||
|
||||
git remote set-url --push origin `git config remote.origin.url | sed -e 's/^git:/https:/'`
|
||||
|
||||
if ! (git remote set-branches --add origin gh-pages && git fetch -q); then
|
||||
echo "No gh-pages, so not syncing"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if ! [ -d target/generated-docs ]; then
|
||||
echo "No gh-pages sources in target/generated-docs, so not syncing"
|
||||
exit 0
|
||||
fi
|
||||
|
||||
# Stash any outstanding changes
|
||||
###################################################################
|
||||
git diff-index --quiet HEAD
|
||||
dirty=$?
|
||||
if [ "$dirty" != "0" ]; then git stash; fi
|
||||
|
||||
# Switch to gh-pages branch to sync it with master
|
||||
###################################################################
|
||||
git checkout gh-pages
|
||||
|
||||
for f in target/generated-docs/*; do
|
||||
file=${f#target/generated-docs/*}
|
||||
if ! git ls-files -i -o --exclude-standard --directory | grep -q ^$file$; then
|
||||
# Not ignored...
|
||||
cp -rf $f .
|
||||
git add -A $file
|
||||
fi
|
||||
done
|
||||
|
||||
git commit -a -m "Sync docs from master to gh-pages"
|
||||
|
||||
# Uncomment the following push if you want to auto push to
|
||||
# the gh-pages branch whenever you commit to master locally.
|
||||
# This is a little extreme. Use with care!
|
||||
###################################################################
|
||||
git push origin gh-pages
|
||||
|
||||
# Finally, switch back to the master branch and exit block
|
||||
git checkout master
|
||||
if [ "$dirty" != "0" ]; then git stash pop; fi
|
||||
|
||||
exit 0
|
||||
@@ -1,15 +0,0 @@
|
||||
Spring Cloud for Cloudfoundry makes it easy to run
|
||||
https://github.com/spring-cloud[Spring Cloud] apps in
|
||||
https://github.com/cloudfoundry[Cloud Foundry] (the Platform as a
|
||||
Service). Cloud Foundry has the notion of a "service", which is
|
||||
middlware that you "bind" to an app, essentially providing it with an
|
||||
environment variable containing credentials (e.g. the location and
|
||||
username to use for the service).
|
||||
|
||||
Add this project as a dependency to any Spring Cloud UI app or REST
|
||||
service and deploy to Cloudfoundry. If you use Spring Cloud Security
|
||||
OAuth2 features this will make them bindable to Cloud Foundry services
|
||||
instead of enironment properties in `spring.oauth2.*`. For a UI app you can
|
||||
declare `@EnableOAuth2Sso` and bind to a service called "sso", and for
|
||||
a service you can add `@EnableOAuth2Resource` and bind to a service
|
||||
called "resource" (see below for how to change the names).
|
||||
@@ -1,50 +0,0 @@
|
||||
Here's a Spring Cloud app with OAuth2 SSO:
|
||||
|
||||
.app.groovy
|
||||
[source,java]
|
||||
----
|
||||
@Controller
|
||||
@EnableOAuth2Sso
|
||||
class Application {
|
||||
|
||||
@RequestMapping('/')
|
||||
String home() {
|
||||
'Hello World'
|
||||
}
|
||||
|
||||
}
|
||||
----
|
||||
|
||||
If you run it without any service bindings:
|
||||
|
||||
----
|
||||
$ spring jar app.jar app.groovy
|
||||
$ cf push -p app.jar
|
||||
----
|
||||
|
||||
it will be secure with (Spring Boot default) Basic authentication,
|
||||
i.e. the password will be in the logs (or set it with
|
||||
`security.user.password` as normal). To turn on OAuth2 SSO all you
|
||||
need to do is bind the app to a service with the right
|
||||
credentials. For example, a
|
||||
http://docs.pivotal.io/pivotalcf/devguide/services/user-provided.html[user-provided
|
||||
service] can be created like this on PWS:
|
||||
|
||||
----
|
||||
$ cf create-user-provided-service sso -p '{clientId:"<my-client>",clientSecret:"<my-secret>",userInfoUri:"https://uaa.run.pivotal.io/userinfo",tokenUri: "https://login.run.pivotal.io/oauth/token",authorizationUri:"https://login.run.pivotal.io/oauth/authorize"}
|
||||
----
|
||||
|
||||
Then bind and restart the app:
|
||||
|
||||
----
|
||||
$ cf bind app sso
|
||||
$ cf restart app
|
||||
----
|
||||
|
||||
and visit it in a browser. It will redirect to the Cloud Foundry (PWS)
|
||||
login server instead of challenging for Basic authentication. The
|
||||
`clientId` and `clientSecret` are credentials of a registered client
|
||||
in Cloud Foundry. To get a Cloud Foundry client registration for
|
||||
testing please ask your local platform administrator if it's a private
|
||||
instance).
|
||||
|
||||
@@ -1,75 +0,0 @@
|
||||
= Spring Cloud for Cloud Foundry
|
||||
|
||||
include::intro.adoc[]
|
||||
|
||||
== Quickstart
|
||||
|
||||
include::quickstart.adoc[]
|
||||
|
||||
== How Does it Work?
|
||||
|
||||
=== OAuth2 Single Sign On
|
||||
|
||||
Spring Cloud Security provides the `@EnableOAuth2Sso` annotation and
|
||||
binds the app to environment properties in `spring.oauth2.\*`. Spring Cloud
|
||||
for Cloud Foundry just sets up default environment properties so that
|
||||
it all just works if you bind to a Cloud Foundry service instance
|
||||
called "sso". The service credentials are mapped to the SSO
|
||||
properties, i.e. (from `spring.oauth2.client.*`) `clientId`, `clientSecret`,
|
||||
`tokenUri`, `authorizationUri`, (and from `spring.oauth2.resource.*`)
|
||||
`userInfoUri`, `tokenInfoUri`, `keyValue`, `keyUri`. Refer to the
|
||||
Spring Cloud Security documentation for details of which combinations
|
||||
will work together. The main thing is that in Cloud Foundry you only
|
||||
need one service to cover all the necessary credentials.
|
||||
|
||||
To use a different service instance name (i.e. not "sso") just set
|
||||
`spring.oauth2.sso.serviceId` to your custom name.
|
||||
|
||||
=== JWT Tokens
|
||||
|
||||
Spring Cloud Security already has support for decoding JWT tokens if
|
||||
you just provide the verification key (as an environment property). In
|
||||
Cloud Foundry you can pick that property up from a service binding
|
||||
(`keyValue` or `keyUri`).
|
||||
|
||||
For example the `keyUri` in PWS is
|
||||
"https://uaa.run.pivotal.io/token_key":
|
||||
|
||||
----
|
||||
$ curl https://uaa.run.pivotal.io/token_key
|
||||
{"alg":"SHA256withRSA","value":"-----BEGIN PUBLIC KEY-----\nMIIBI...\n-----END PUBLIC KEY-----\n"}d
|
||||
----
|
||||
|
||||
=== OAuth2 Resource Server
|
||||
|
||||
Similarly, the `@EnableOAuth2Resource` annotation will protect your
|
||||
API endpoints if you bind to a service instance called "resource".
|
||||
The "sso" service above will work for a resource server as well (so
|
||||
just bind to that if it's there). If the OAuth2 tokens are JWTs (as in
|
||||
Cloud Foundry), it is common to use a separate service for resources
|
||||
to avoid a network round trip decoding the token on every access. A
|
||||
user-provided-service for an OAuth2 resource can be created like this
|
||||
on PWS:
|
||||
|
||||
----
|
||||
$ cf create-user-provided-service resource -p '{keyUri:"https://uaa.run.pivotal.io/token_key"}
|
||||
----
|
||||
|
||||
To use JWT you need to add the verification key as either
|
||||
`keyValue` or `keyUri` (these could be added to the "sso"
|
||||
service or the "resource" service if you have one).
|
||||
|
||||
To use a different sercice instance name (i.e. not "resource" or
|
||||
"sso") just set `spring.oauth2.resource.serviceId` to your custom name.
|
||||
|
||||
=== Default Environment Keys
|
||||
|
||||
The precise mapppings are as follows:
|
||||
|
||||
* `spring.oauth2.sso.\*` to `vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*`
|
||||
|
||||
* `spring.oauth2.client.\*` to `vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.tokenUri:${vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.*`
|
||||
|
||||
* `spring.oauth2.resource.(jwt).\*` to `vcap.services.${spring.oauth2.resource.serviceId:resource}.credentials.tokenUri:${vcap.services.${spring.oauth2.sso.serviceId:sso}.credentials.*`
|
||||
|
||||
|
||||
@@ -1,30 +0,0 @@
|
||||
#!/usr/bin/env ruby
|
||||
|
||||
base_dir = File.join(File.dirname(__FILE__),'../../..')
|
||||
src_dir = File.join(base_dir, "/src/main/asciidoc")
|
||||
require 'asciidoctor'
|
||||
require 'optparse'
|
||||
|
||||
options = {}
|
||||
file = "#{src_dir}/README.adoc"
|
||||
|
||||
OptionParser.new do |o|
|
||||
o.on('-o OUTPUT_FILE', 'Output file (default is stdout)') { |file| options[:to_file] = file unless file=='-' }
|
||||
o.on('-h', '--help') { puts o; exit }
|
||||
o.parse!
|
||||
end
|
||||
|
||||
file = ARGV[0] if ARGV.length>0
|
||||
|
||||
srcDir = File.dirname(file)
|
||||
out = "// Do not edit this file (e.g. go instead to src/main/asciidoc)\n\n"
|
||||
doc = Asciidoctor.load_file file, safe: :safe, parse: false
|
||||
out << doc.reader.read
|
||||
|
||||
unless options[:to_file]
|
||||
puts out
|
||||
else
|
||||
File.open(options[:to_file],'w+') do |file|
|
||||
file.write(out)
|
||||
end
|
||||
end
|
||||
Reference in New Issue
Block a user