SpringCloud/spring-cloud-vault
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Make Azure auth metadata URIs configurable

Browse Source 
Original pull request: gh-495
See gh-451
This commit is contained in:
infa-szhong
2020-09-24 02:37:18 -07:00
committed by Mark Paluch
parent 4ee35edc6c
commit 224ae41d1b
3 changed files with 39 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
docs/src/main/asciidoc/authentication.adoc
View File

@@ -381,15 +381,21 @@ spring.cloud.vault:
azure-msi:
role: my-dev-role
azure-path: azure
metadata-service: http://169.254.169.254/metadata/instance...
identity-token-service: http://169.254.169.254/metadata/identity...
----
====
* `role` sets the name of the role against which the login is being attempted.
* `azure-path` sets the path of the Azure mount to use
* `metadata-service` sets the URI at which to access the instance metadata service
* `identity-token-service` sets the URI at which to access the identity token service
Azure MSI authentication fetches environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service.
Azure MSI authentication fetches environmental details about the virtual machine (subscription Id, resource group, VM name) from the instance metadata service. By default, Azure assumes your Vault server has Resource ID `https://vault.hashicorp.com`. To change this, set `spring.cloud.vault.azure-msi.identity-token-service`.
See also: https://www.vaultproject.io/docs/auth/azure.html[Vault Documentation: Using the azure auth backend]
See also:
* https://www.vaultproject.io/docs/auth/azure.html[Vault Documentation: Using the azure auth backend]
* https://docs.microsoft.com/en-us/azure/virtual-machines/windows/instance-metadata-service[Azure Documentation: Azure Instance Metadata Service]
[[vault.config.authentication.clientcert]]
=== TLS certificate authentication

5
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java
View File

@@ -303,7 +303,10 @@ class ClientAuthenticationFactory {
Assert.hasText(azureMsi.getRole(), "Azure role (spring.cloud.vault.azure-msi.role) must not be empty");
AzureMsiAuthenticationOptions options = AzureMsiAuthenticationOptions.builder().role(azureMsi.getRole())
AzureMsiAuthenticationOptions options = AzureMsiAuthenticationOptions.builder() //
.role(azureMsi.getRole()).path(azureMsi.getAzurePath()) //
.instanceMetadataUri(azureMsi.getMetadataService()) //
.identityTokenServiceUri(azureMsi.getIdentityTokenService()) //
.build();
return new AzureMsiAuthentication(options, this.restOperations, this.externalRestOperations);

27
spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/VaultProperties.java
View File

@@ -26,6 +26,7 @@ import org.springframework.core.env.Environment;
import org.springframework.core.io.Resource;
import org.springframework.lang.Nullable;
import org.springframework.util.StringUtils;
import org.springframework.vault.authentication.AzureMsiAuthenticationOptions;
import org.springframework.vault.authentication.LoginToken;
import org.springframework.vault.core.lease.LeaseEndpoints;
@@ -666,6 +667,16 @@ public class VaultProperties implements EnvironmentAware {
*/
private String role = "";
/**
* Instance metadata service URI
*/
private URI metadataService = AzureMsiAuthenticationOptions.DEFAULT_INSTANCE_METADATA_SERVICE_URI;
/**
* Identity token service URI
*/
private URI identityTokenService = AzureMsiAuthenticationOptions.DEFAULT_IDENTITY_TOKEN_SERVICE_URI;
public String getAzurePath() {
return this.azurePath;
}
@@ -674,6 +685,14 @@ public class VaultProperties implements EnvironmentAware {
return this.role;
}
public URI getMetadataService() {
return metadataService;
}
public URI getIdentityTokenService() {
return identityTokenService;
}
public void setAzurePath(String azurePath) {
this.azurePath = azurePath;
}
@@ -682,6 +701,14 @@ public class VaultProperties implements EnvironmentAware {
this.role = role;
}
public void setMetadataService(URI metadataService) {
this.metadataService = metadataService;
}
public void setIdentityTokenService(URI identityTokenService) {
this.identityTokenService = identityTokenService;
}
}
/**