From e15e6a7d6dce14518dc88021874a47adada2bd7d Mon Sep 17 00:00:00 2001 From: Olga Maciaszek-Sharma Date: Wed, 5 Oct 2022 12:17:00 +0200 Subject: [PATCH] Simlify encryption config for aot (#2173) --- ...efaultTextEncryptionAutoConfiguration.java | 71 ++++++++++++++++ .../config/EncryptionAutoConfiguration.java | 82 ++----------------- .../RsaEncryptionAutoConfiguration.java | 66 +++++++++++++++ .../main/resources/META-INF/spring.factories | 2 + ...ot.autoconfigure.AutoConfiguration.imports | 2 + 5 files changed, 149 insertions(+), 74 deletions(-) create mode 100644 spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/DefaultTextEncryptionAutoConfiguration.java create mode 100644 spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/RsaEncryptionAutoConfiguration.java diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/DefaultTextEncryptionAutoConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/DefaultTextEncryptionAutoConfiguration.java new file mode 100644 index 00000000..ab0ce244 --- /dev/null +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/DefaultTextEncryptionAutoConfiguration.java @@ -0,0 +1,71 @@ +/* + * Copyright 2002-2022 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.config.server.config; + +import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.autoconfigure.AutoConfigureAfter; +import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.cloud.bootstrap.encrypt.KeyProperties; +import org.springframework.cloud.config.server.encryption.LocatorTextEncryptor; +import org.springframework.cloud.config.server.encryption.TextEncryptorLocator; +import org.springframework.cloud.context.encrypt.EncryptorFactory; +import org.springframework.context.ApplicationContext; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.crypto.encrypt.Encryptors; +import org.springframework.security.crypto.encrypt.TextEncryptor; +import org.springframework.util.StringUtils; + +/** + * Default text encryption auto-configuration. + * + * @author Olga Maciaszek-Sharma + * @since 4.0.0 + */ +@Configuration(proxyBeanMethods = false) +@AutoConfigureAfter(RsaEncryptionAutoConfiguration.class) +@EnableConfigurationProperties +public class DefaultTextEncryptionAutoConfiguration { + + @Autowired + ApplicationContext context; + + @Bean + @ConditionalOnMissingBean + public KeyProperties keyProperties() { + return new KeyProperties(); + } + + @Bean + @ConditionalOnMissingBean(TextEncryptor.class) + @ConditionalOnBean(TextEncryptorLocator.class) + public TextEncryptor defaultLocatorBasedTextEncryptor(TextEncryptorLocator locator) { + return new LocatorTextEncryptor(locator); + } + + @Bean + @ConditionalOnMissingBean(TextEncryptor.class) + public TextEncryptor defaultTextEncryptor(KeyProperties key) { + if (StringUtils.hasText(key.getKey())) { + return new EncryptorFactory(key.getSalt()).create(key.getKey()); + } + return Encryptors.noOpText(); + } + +} diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java index f3f73e61..310fb975 100644 --- a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/EncryptionAutoConfiguration.java @@ -17,34 +17,21 @@ package org.springframework.cloud.config.server.config; import org.springframework.beans.factory.annotation.Autowired; +import org.springframework.boot.autoconfigure.AutoConfigureAfter; import org.springframework.boot.autoconfigure.condition.ConditionalOnBean; -import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; -import org.springframework.boot.context.properties.EnableConfigurationProperties; -import org.springframework.cloud.bootstrap.encrypt.KeyProperties; -import org.springframework.cloud.bootstrap.encrypt.KeyProperties.KeyStore; -import org.springframework.cloud.bootstrap.encrypt.RsaProperties; import org.springframework.cloud.config.server.encryption.CipherEnvironmentEncryptor; import org.springframework.cloud.config.server.encryption.EnvironmentEncryptor; -import org.springframework.cloud.config.server.encryption.KeyStoreTextEncryptorLocator; -import org.springframework.cloud.config.server.encryption.LocatorTextEncryptor; import org.springframework.cloud.config.server.encryption.SingleTextEncryptorLocator; import org.springframework.cloud.config.server.encryption.TextEncryptorLocator; -import org.springframework.cloud.context.encrypt.EncryptorFactory; import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; -import org.springframework.context.annotation.Import; -import org.springframework.security.crypto.encrypt.Encryptors; import org.springframework.security.crypto.encrypt.TextEncryptor; -import org.springframework.security.rsa.crypto.KeyStoreKeyFactory; -import org.springframework.security.rsa.crypto.RsaAlgorithm; -import org.springframework.security.rsa.crypto.RsaSecretEncryptor; -import org.springframework.util.StringUtils; /** - * Auto configuration for text encryptors and environment encryptors (non-web stuff). - * Users can provide beans of the same type as any or all of the beans defined here in + * Autoconfiguration for text encryptors and environment encryptors (non-web stuff). Users + * can provide beans of the same type as any or all of the beans defined here in * application code to override the default behaviour. * * @author Bartosz Wojtkiewicz @@ -54,14 +41,14 @@ import org.springframework.util.StringUtils; * */ @Configuration(proxyBeanMethods = false) -@EnableConfigurationProperties -@Import(SingleTextEncryptorConfiguration.class) +@AutoConfigureAfter(DefaultTextEncryptionAutoConfiguration.class) public class EncryptionAutoConfiguration { @Bean - @ConditionalOnMissingBean - public KeyProperties keyProperties() { - return new KeyProperties(); + @ConditionalOnBean(TextEncryptor.class) + @ConditionalOnMissingBean(TextEncryptorLocator.class) + public SingleTextEncryptorLocator singleTextEncryptorLocator(TextEncryptor encryptor) { + return new SingleTextEncryptorLocator(encryptor); } @Bean @@ -76,57 +63,4 @@ public class EncryptionAutoConfiguration { return new CipherEnvironmentEncryptor(locator); } - @Bean - @ConditionalOnMissingBean(TextEncryptor.class) - public TextEncryptor defaultTextEncryptor(@Autowired(required = false) TextEncryptorLocator locator, - KeyProperties key) { - if (locator != null) { - return new LocatorTextEncryptor(locator); - } - if (StringUtils.hasText(key.getKey())) { - return new EncryptorFactory(key.getSalt()).create(key.getKey()); - } - return Encryptors.noOpText(); - } - - @Configuration(proxyBeanMethods = false) - @ConditionalOnClass(RsaSecretEncryptor.class) - @ConditionalOnProperty(prefix = "encrypt.key-store", value = "location", matchIfMissing = false) - protected static class KeyStoreConfiguration { - - @Autowired - private KeyProperties key; - - @Autowired - private RsaProperties rsaProperties; - - @Bean - @ConditionalOnMissingBean - public TextEncryptorLocator textEncryptorLocator() { - KeyStore keyStore = key.getKeyStore(); - KeyStoreTextEncryptorLocator locator = new KeyStoreTextEncryptorLocator( - new KeyStoreKeyFactory(keyStore.getLocation(), keyStore.getPassword().toCharArray(), - key.getKeyStore().getType()), - keyStore.getSecret(), keyStore.getAlias()); - RsaAlgorithm algorithm = this.rsaProperties.getAlgorithm(); - locator.setRsaAlgorithm(algorithm); - locator.setSalt(this.rsaProperties.getSalt()); - locator.setStrong(this.rsaProperties.isStrong()); - return locator; - } - - } - -} - -@ConditionalOnBean(TextEncryptor.class) -@ConditionalOnMissingBean(TextEncryptorLocator.class) -@Configuration(proxyBeanMethods = false) -class SingleTextEncryptorConfiguration { - - @Bean - public SingleTextEncryptorLocator textEncryptorLocator(TextEncryptor encryptor) { - return new SingleTextEncryptorLocator(encryptor); - } - } diff --git a/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/RsaEncryptionAutoConfiguration.java b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/RsaEncryptionAutoConfiguration.java new file mode 100644 index 00000000..be84ad25 --- /dev/null +++ b/spring-cloud-config-server/src/main/java/org/springframework/cloud/config/server/config/RsaEncryptionAutoConfiguration.java @@ -0,0 +1,66 @@ +/* + * Copyright 2002-2022 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.config.server.config; + +import org.springframework.boot.autoconfigure.condition.ConditionalOnClass; +import org.springframework.boot.autoconfigure.condition.ConditionalOnMissingBean; +import org.springframework.boot.autoconfigure.condition.ConditionalOnProperty; +import org.springframework.boot.context.properties.EnableConfigurationProperties; +import org.springframework.cloud.bootstrap.encrypt.KeyProperties; +import org.springframework.cloud.bootstrap.encrypt.RsaProperties; +import org.springframework.cloud.config.server.encryption.KeyStoreTextEncryptorLocator; +import org.springframework.cloud.config.server.encryption.TextEncryptorLocator; +import org.springframework.context.annotation.Bean; +import org.springframework.context.annotation.Configuration; +import org.springframework.security.rsa.crypto.KeyStoreKeyFactory; +import org.springframework.security.rsa.crypto.RsaAlgorithm; +import org.springframework.security.rsa.crypto.RsaSecretEncryptor; + +/** + * Autoconfiguration for RSA encryption. + * + * @author Olga Maciaszek-Sharma + * @since 4.0.0 + */ +@Configuration(proxyBeanMethods = false) +@ConditionalOnProperty(prefix = "encrypt.key-store", value = "location") +@ConditionalOnClass(RsaSecretEncryptor.class) +@EnableConfigurationProperties +public class RsaEncryptionAutoConfiguration { + + @Bean + @ConditionalOnMissingBean + public KeyProperties keyProperties() { + return new KeyProperties(); + } + + @Bean + @ConditionalOnMissingBean + public TextEncryptorLocator textEncryptorLocator(KeyProperties key, RsaProperties rsaProperties) { + KeyProperties.KeyStore keyStore = key.getKeyStore(); + KeyStoreTextEncryptorLocator locator = new KeyStoreTextEncryptorLocator( + new KeyStoreKeyFactory(keyStore.getLocation(), keyStore.getPassword().toCharArray(), + key.getKeyStore().getType()), + keyStore.getSecret(), keyStore.getAlias()); + RsaAlgorithm algorithm = rsaProperties.getAlgorithm(); + locator.setRsaAlgorithm(algorithm); + locator.setSalt(rsaProperties.getSalt()); + locator.setStrong(rsaProperties.isStrong()); + return locator; + } + +} diff --git a/spring-cloud-config-server/src/main/resources/META-INF/spring.factories b/spring-cloud-config-server/src/main/resources/META-INF/spring.factories index a2cb54dd..89f75940 100644 --- a/spring-cloud-config-server/src/main/resources/META-INF/spring.factories +++ b/spring-cloud-config-server/src/main/resources/META-INF/spring.factories @@ -1,6 +1,8 @@ # Bootstrap components org.springframework.cloud.bootstrap.BootstrapConfiguration=\ org.springframework.cloud.config.server.bootstrap.ConfigServerBootstrapConfiguration,\ +org.springframework.cloud.config.server.config.DefaultTextEncryptionAutoConfiguration,\ +org.springframework.cloud.config.server.config.RsaEncryptionAutoConfiguration,\ org.springframework.cloud.config.server.config.EncryptionAutoConfiguration # Environment PostProcessor diff --git a/spring-cloud-config-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports b/spring-cloud-config-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports index b8ba3745..a47654bd 100644 --- a/spring-cloud-config-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports +++ b/spring-cloud-config-server/src/main/resources/META-INF/spring/org.springframework.boot.autoconfigure.AutoConfiguration.imports @@ -1,3 +1,5 @@ org.springframework.cloud.config.server.config.ConfigServerAutoConfiguration +org.springframework.cloud.config.server.config.RsaEncryptionAutoConfiguration +org.springframework.cloud.config.server.config.DefaultTextEncryptionAutoConfiguration org.springframework.cloud.config.server.config.EncryptionAutoConfiguration org.springframework.cloud.config.server.config.VaultEncryptionAutoConfiguration