From 47f949a496be8b76524a413db17489cdc2079edd Mon Sep 17 00:00:00 2001 From: user40d Date: Mon, 20 Sep 2021 13:49:12 -0500 Subject: [PATCH] Consider `spring.cloud.vault.ssl.cert-auth-path` for TLS authentication. Closes gh-610 Original pull request: gh-612. --- .../config/ClientAuthenticationFactory.java | 13 +- .../ClientAuthenticationFactoryUnitTests.java | 15 +++ ...igTlsCertAuthenticationMountPathTests.java | 111 ++++++++++++++++++ 3 files changed, 138 insertions(+), 1 deletion(-) create mode 100644 spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationMountPathTests.java diff --git a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java index 521710fd..5b9d4f50 100644 --- a/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java +++ b/spring-cloud-vault-config/src/main/java/org/springframework/cloud/vault/config/ClientAuthenticationFactory.java @@ -47,6 +47,7 @@ import org.springframework.vault.authentication.AzureMsiAuthentication; import org.springframework.vault.authentication.AzureMsiAuthenticationOptions; import org.springframework.vault.authentication.ClientAuthentication; import org.springframework.vault.authentication.ClientCertificateAuthentication; +import org.springframework.vault.authentication.ClientCertificateAuthenticationOptions; import org.springframework.vault.authentication.CubbyholeAuthentication; import org.springframework.vault.authentication.CubbyholeAuthenticationOptions; import org.springframework.vault.authentication.GcpComputeAuthentication; @@ -71,6 +72,7 @@ import org.springframework.web.client.RestOperations; * @author Mark Paluch * @author Kevin Holditch * @author Michal Budzyn + * @author Quincy Conduff * @since 1.1 */ class ClientAuthenticationFactory { @@ -118,7 +120,7 @@ class ClientAuthenticationFactory { return azureMsiAuthentication(this.vaultProperties); case CERT: - return new ClientCertificateAuthentication(this.restOperations); + return certificateAuthentication(this.vaultProperties, this.restOperations); case CUBBYHOLE: return cubbyholeAuthentication(); @@ -388,6 +390,15 @@ class ClientAuthenticationFactory { return new PcfAuthentication(builder.build(), this.restOperations); } + private ClientAuthentication certificateAuthentication(VaultProperties vaultProperties, + RestOperations restOperations) { + + ClientCertificateAuthenticationOptions options = ClientCertificateAuthenticationOptions.builder() + .path(vaultProperties.getSsl().getCertAuthPath()).build(); + + return new ClientCertificateAuthentication(options, this.restOperations); + } + private static class AwsCredentialProvider { private static AWSCredentialsProvider getAwsCredentialsProvider() { diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/ClientAuthenticationFactoryUnitTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/ClientAuthenticationFactoryUnitTests.java index ca803e4c..e1c84d36 100644 --- a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/ClientAuthenticationFactoryUnitTests.java +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/ClientAuthenticationFactoryUnitTests.java @@ -23,6 +23,7 @@ import org.springframework.vault.authentication.AppRoleAuthenticationOptions; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.RoleId; import org.springframework.vault.authentication.AppRoleAuthenticationOptions.SecretId; import org.springframework.vault.authentication.ClientAuthentication; +import org.springframework.vault.authentication.ClientCertificateAuthentication; import org.springframework.vault.authentication.PcfAuthentication; import org.springframework.vault.support.VaultToken; import org.springframework.web.client.RestTemplate; @@ -34,6 +35,7 @@ import static org.assertj.core.api.Assertions.assertThatThrownBy; * Unit tests for {@link ClientAuthenticationFactory}. * * @author Mark Paluch + * @author Quincy Conduff */ public class ClientAuthenticationFactoryUnitTests { @@ -163,4 +165,17 @@ public class ClientAuthenticationFactoryUnitTests { assertThat(clientAuthentication).isInstanceOf(PcfAuthentication.class); } + @Test + public void shouldSupportSslCertificateAuthentication() { + + VaultProperties properties = new VaultProperties(); + properties.setAuthentication(VaultProperties.AuthenticationMethod.CERT); + properties.getSsl().setCertAuthPath("bert"); + + ClientAuthentication clientAuthentication = new ClientAuthenticationFactory(properties, new RestTemplate(), + new RestTemplate()).createClientAuthentication(); + + assertThat(clientAuthentication).isInstanceOf(ClientCertificateAuthentication.class); + } + } diff --git a/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationMountPathTests.java b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationMountPathTests.java new file mode 100644 index 00000000..7671416f --- /dev/null +++ b/spring-cloud-vault-config/src/test/java/org/springframework/cloud/vault/config/VaultConfigTlsCertAuthenticationMountPathTests.java @@ -0,0 +1,111 @@ +/* + * Copyright 2016-2021 the original author or authors. + * + * Licensed under the Apache License, Version 2.0 (the "License"); + * you may not use this file except in compliance with the License. + * You may obtain a copy of the License at + * + * https://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ + +package org.springframework.cloud.vault.config; + +import java.io.File; +import java.nio.charset.StandardCharsets; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; + +import org.assertj.core.util.Files; +import org.junit.BeforeClass; +import org.junit.Test; +import org.junit.runner.RunWith; +import org.springframework.beans.factory.annotation.Value; +import org.springframework.boot.SpringApplication; +import org.springframework.boot.autoconfigure.SpringBootApplication; +import org.springframework.boot.test.context.SpringBootTest; +import org.springframework.cloud.vault.util.Settings; +import org.springframework.cloud.vault.util.VaultRule; +import org.springframework.test.context.junit4.SpringRunner; +import org.springframework.vault.core.VaultOperations; +import org.springframework.vault.support.VaultMount; + +import static org.assertj.core.api.Assertions.assertThat; +import static org.springframework.cloud.vault.util.Settings.findWorkDir; + +/** + * Integration test using config infrastructure with TLS certificate authentication. In + * case this test should fail because of SSL make sure you run the test within the + * spring-cloud-vault-config/spring-cloud-vault-config directory as the keystore is + * referenced with {@code ../work/keystore.jks}. + * + * @author Quincy Conduff + */ +@RunWith(SpringRunner.class) +@SpringBootTest(classes = VaultConfigTlsCertAuthenticationMountPathTests.TestApplication.class, properties = { + "spring.cloud.vault.authentication=CERT", "spring.cloud.vault.ssl.key-store=file:../work/client-cert.jks", + "spring.cloud.vault.ssl.key-store-password=changeit", "spring.cloud.vault.ssl.cert-auth-path=nonstandard", + "spring.cloud.vault.application-name=VaultConfigTlsCertAuthenticationMountPathTests", + "spring.cloud.vault.reactive.enabled=false", "spring.cloud.bootstrap.enabled=true" }) +public class VaultConfigTlsCertAuthenticationMountPathTests { + + @Value("${vault.value}") + String configValue; + + @BeforeClass + public static void beforeClass() { + + VaultRule vaultRule = new VaultRule(); + vaultRule.before(); + + VaultProperties vaultProperties = Settings.createVaultProperties(); + + vaultProperties.getSsl().setCertAuthPath("nonstandard"); + + if (!vaultRule.prepare().hasAuth(vaultProperties.getSsl().getCertAuthPath())) { + vaultRule.prepare().getVaultOperations().opsForSys().authMount(vaultProperties.getSsl().getCertAuthPath(), + VaultMount.builder().type("cert").build()); + } + + VaultOperations vaultOperations = vaultRule.prepare().getVaultOperations(); + + String rules = "path \"*\" {\n capabilities = [\"read\"]\n}"; + + vaultOperations.write("sys/policy/testpolicy", Collections.singletonMap("policy", rules)); + + vaultOperations.write("secret/" + VaultConfigTlsCertAuthenticationMountPathTests.class.getSimpleName(), + Collections.singletonMap("vault.value", "foo")); + + File workDir = findWorkDir(); + + String certificate = Files.contentOf(new File(workDir, "ca/certs/client.cert.pem"), StandardCharsets.US_ASCII); + + Map role = new HashMap<>(); + role.put("certificate", certificate); + role.put("policies", "testpolicy"); + + vaultOperations.write(String.join("/", "auth", vaultProperties.getSsl().getCertAuthPath(), "certs", "my-role"), + role); + } + + @Test + public void contextLoads() { + assertThat(this.configValue).isEqualTo("foo"); + } + + @SpringBootApplication + public static class TestApplication { + + public static void main(String[] args) { + SpringApplication.run(TestApplication.class, args); + } + + } + +}