From 03dd5e36c01049bcd2d31af5b297b5e2ad84c7dd Mon Sep 17 00:00:00 2001 From: Mark Paluch Date: Thu, 11 May 2017 17:00:52 +0200 Subject: [PATCH] Allow configuration of AWS-EC2 nonce. We now support static configuration of the AWS-EC2 authentication nonce to support re-login on application crashes/vm-internal restarts. Closes gh-103. --- docs/src/main/asciidoc/spring-cloud-vault.adoc | 16 +++------------- .../config/VaultBootstrapConfiguration.java | 5 +++++ .../cloud/vault/config/VaultProperties.java | 13 ++++++++++++- 3 files changed, 20 insertions(+), 14 deletions(-) diff --git a/docs/src/main/asciidoc/spring-cloud-vault.adoc b/docs/src/main/asciidoc/spring-cloud-vault.adoc index ebfa73ef..ec1168b1 100644 --- a/docs/src/main/asciidoc/spring-cloud-vault.adoc +++ b/docs/src/main/asciidoc/spring-cloud-vault.adoc @@ -240,17 +240,7 @@ party does not have the nonce and can raise an alert in Vault for further investigation. The nonce is kept in memory and is lost during application restart. - -.bootstrap.yml with disabled nonce -==== -[source,yaml] ----- -spring.cloud.vault: - authentication: AWS_EC2 - aws-ec2: - use-nonce: false ----- -==== +You can configure a static nonce with `spring.cloud.vault.aws-ec2.nonce`. AWS-EC2 authentication roles are optional and default to the AMI. You can configure the authentication role by setting the @@ -277,7 +267,7 @@ spring.cloud.vault: role: application-server aws-ec2-path: aws-ec2 identity-document: http://... - use-nonce: false + nonce: my-static-nonce ---- ==== @@ -286,7 +276,7 @@ authentication method * `role` sets the role name of the AWS EC2 role definition * `aws-ec2-path` sets the path of the AWS EC2 mount to use * `identity-document` sets URL of the PKCS#7 AWS EC2 identity document -* `use-nonce` setting this value to `false` will disable nonce usage +* `nonce` used for AWS-EC2 authentication. An empty nonce defaults to nonce generation See also: https://www.vaultproject.io/docs/auth/aws-ec2.html[Vault Documentation: Using the aws-ec2 auth backend] diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultBootstrapConfiguration.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultBootstrapConfiguration.java index 25ddc44d..b609da20 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultBootstrapConfiguration.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultBootstrapConfiguration.java @@ -45,6 +45,7 @@ import org.springframework.vault.authentication.AppRoleAuthentication; import org.springframework.vault.authentication.AppRoleAuthenticationOptions; import org.springframework.vault.authentication.AwsEc2Authentication; import org.springframework.vault.authentication.AwsEc2AuthenticationOptions; +import org.springframework.vault.authentication.AwsEc2AuthenticationOptions.Nonce; import org.springframework.vault.authentication.ClientAuthentication; import org.springframework.vault.authentication.ClientCertificateAuthentication; import org.springframework.vault.authentication.CubbyholeAuthentication; @@ -360,9 +361,13 @@ public class VaultBootstrapConfiguration implements InitializingBean { VaultProperties.AwsEc2Properties awsEc2 = vaultProperties.getAwsEc2(); + Nonce nonce = StringUtils.hasText(awsEc2.getNonce()) + ? Nonce.provided(awsEc2.getNonce().toCharArray()) : Nonce.generated(); + AwsEc2AuthenticationOptions authenticationOptions = AwsEc2AuthenticationOptions .builder().role(awsEc2.getRole()) // .path(awsEc2.getAwsEc2Path()) // + .nonce(nonce) // .identityDocumentUri(URI.create(awsEc2.getIdentityDocument())) // .build(); diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java index f7018409..febf26ee 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java @@ -13,15 +13,16 @@ * See the License for the specific language governing permissions and * limitations under the License. */ - package org.springframework.cloud.vault.config; import lombok.Data; +import lombok.Getter; import org.hibernate.validator.constraints.NotEmpty; import org.hibernate.validator.constraints.Range; import org.springframework.boot.bind.RelaxedPropertyResolver; import org.springframework.boot.context.properties.ConfigurationProperties; +import org.springframework.boot.context.properties.DeprecatedConfigurationProperty; import org.springframework.context.EnvironmentAware; import org.springframework.core.env.Environment; import org.springframework.core.io.Resource; @@ -184,8 +185,18 @@ public class VaultProperties implements EnvironmentAware { /** * Flag whether to generate and send a nonce. + * + * @deprecated not used, will be removed in a future version. */ + @Getter(onMethod = @__(@DeprecatedConfigurationProperty(reason = "not used"))) + @Deprecated private boolean useNonce = true; + + /** + * Nonce used for AWS-EC2 authentication. An empty nonce defaults to nonce + * generation. + */ + private String nonce; } @Data