Skip to content

Commit bfbaa44

Browse files
artem-vartem-v
authored
Auth refactoring (#108)
* Fixed builders * Enhanced VaultServiceRolesInstaller * Fixed identity-role generation * Minor changes * Added constructor validations to prevent NPEs * Fixed audit logs
1 parent 17f68d8 commit bfbaa44

File tree

6 files changed

+59
-39
lines changed

6 files changed

+59
-39
lines changed

‎tests/src/test/java/io/scalecube/security/tokens/jwt/JsonwebtokenResolverTests.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,7 +29,7 @@ void testResolveTokenSuccessfully(VaultEnvironment vaultEnvironment) throws Exce
2929

3030
final var jwtToken =
3131
new JsonwebtokenResolver(
32-
new JwksKeyLocator.Builder()
32+
JwksKeyLocator.builder()
3333
.jwksUri(vaultEnvironment.jwksUri())
3434
.connectTimeout(Duration.ofSeconds(3))
3535
.requestTimeout(Duration.ofSeconds(3))

‎tests/src/test/java/io/scalecube/security/vault/VaultServiceTokenTests.java‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ public class VaultServiceTokenTests {
3030
void testGetServiceTokenUsingWrongCredentials(VaultEnvironment vaultEnvironment)
3131
throws Exception {
3232
final var serviceTokenSupplier =
33-
new VaultServiceTokenSupplier.Builder()
33+
VaultServiceTokenSupplier.builder()
3434
.vaultAddress(vaultEnvironment.vaultAddr())
3535
.vaultTokenSupplier(() -> completedFuture(randomAlphabetic(16)))
3636
.serviceRole(randomAlphabetic(16))
@@ -52,7 +52,7 @@ void testGetNonExistingServiceToken(VaultEnvironment vaultEnvironment) throws Ex
5252
final var nonExistingServiceRole = "non-existing-role-" + System.currentTimeMillis();
5353

5454
final var serviceTokenSupplier =
55-
new VaultServiceTokenSupplier.Builder()
55+
VaultServiceTokenSupplier.builder()
5656
.vaultAddress(vaultEnvironment.vaultAddr())
5757
.vaultTokenSupplier(() -> completedFuture(vaultEnvironment.login()))
5858
.serviceRole(nonExistingServiceRole)
@@ -76,7 +76,7 @@ void testGetServiceTokenByWrongServiceRole(VaultEnvironment vaultEnvironment) th
7676
final var serviceRole2 = "role2-" + now;
7777
final var serviceRole3 = "role3-" + now;
7878

79-
new VaultServiceRolesInstaller.Builder()
79+
VaultServiceRolesInstaller.builder()
8080
.vaultAddress(vaultEnvironment.vaultAddr())
8181
.vaultTokenSupplier(() -> completedFuture(vaultEnvironment.login()))
8282
.keyNameSupplier(() -> "key-" + now)
@@ -94,7 +94,7 @@ void testGetServiceTokenByWrongServiceRole(VaultEnvironment vaultEnvironment) th
9494
.install();
9595

9696
final var serviceTokenSupplier =
97-
new VaultServiceTokenSupplier.Builder()
97+
VaultServiceTokenSupplier.builder()
9898
.vaultAddress(vaultEnvironment.vaultAddr())
9999
.vaultTokenSupplier(() -> completedFuture(vaultEnvironment.login()))
100100
.serviceRole(serviceRole1)
@@ -117,7 +117,7 @@ void testGetServiceTokenSuccessfully(VaultEnvironment vaultEnvironment) throws E
117117
final var serviceRole = "role-" + now;
118118
final var tags = Map.of("type", "ops", "ns", "develop");
119119

120-
new VaultServiceRolesInstaller.Builder()
120+
VaultServiceRolesInstaller.builder()
121121
.vaultAddress(vaultEnvironment.vaultAddr())
122122
.vaultTokenSupplier(() -> completedFuture(vaultEnvironment.login()))
123123
.keyNameSupplier(() -> "key-" + now)
@@ -128,7 +128,7 @@ void testGetServiceTokenSuccessfully(VaultEnvironment vaultEnvironment) throws E
128128
.install();
129129

130130
final var serviceTokenSupplier =
131-
new VaultServiceTokenSupplier.Builder()
131+
VaultServiceTokenSupplier.builder()
132132
.vaultAddress(vaultEnvironment.vaultAddr())
133133
.vaultTokenSupplier(() -> completedFuture(vaultEnvironment.login()))
134134
.serviceRole(serviceRole)
@@ -142,7 +142,7 @@ void testGetServiceTokenSuccessfully(VaultEnvironment vaultEnvironment) throws E
142142

143143
final var jwtToken =
144144
new JsonwebtokenResolver(
145-
new JwksKeyLocator.Builder().jwksUri(vaultEnvironment.jwksUri()).build())
145+
JwksKeyLocator.builder().jwksUri(vaultEnvironment.jwksUri()).build())
146146
.resolve(serviceToken)
147147
.get(3, TimeUnit.SECONDS);
148148

‎tokens/src/main/java/io/scalecube/security/tokens/jwt/JsonwebtokenResolver.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
import io.jsonwebtoken.Jwts;
44
import io.jsonwebtoken.Locator;
55
import java.security.Key;
6+
import java.util.Objects;
67
import java.util.concurrent.CompletableFuture;
78
import org.slf4j.Logger;
89
import org.slf4j.LoggerFactory;
@@ -14,7 +15,7 @@ public class JsonwebtokenResolver implements JwtTokenResolver {
1415
private final Locator<Key> keyLocator;
1516

1617
public JsonwebtokenResolver(Locator<Key> keyLocator) {
17-
this.keyLocator = keyLocator;
18+
this.keyLocator = Objects.requireNonNull(keyLocator, "keyLocator");
1819
}
1920

2021
@Override

‎tokens/src/main/java/io/scalecube/security/tokens/jwt/JwksKeyLocator.java‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@
2525
import java.time.Duration;
2626
import java.util.Base64;
2727
import java.util.Map;
28+
import java.util.Objects;
2829
import java.util.concurrent.ConcurrentHashMap;
2930
import java.util.concurrent.locks.ReentrantLock;
3031

@@ -41,12 +42,16 @@ public class JwksKeyLocator extends LocatorAdapter<Key> {
4142
private final ReentrantLock cleanupLock = new ReentrantLock();
4243

4344
private JwksKeyLocator(Builder builder) {
44-
this.jwksUri = builder.jwksUri;
45-
this.connectTimeout = builder.connectTimeout;
46-
this.requestTimeout = builder.requestTimeout;
45+
this.jwksUri = Objects.requireNonNull(builder.jwksUri, "jwksUri");
46+
this.connectTimeout = Objects.requireNonNull(builder.connectTimeout, "connectTimeout");
47+
this.requestTimeout = Objects.requireNonNull(builder.requestTimeout, "requestTimeout");
4748
this.keyTtl = builder.keyTtl;
4849
}
4950

51+
public static Builder builder() {
52+
return new Builder();
53+
}
54+
5055
@Override
5156
protected Key locate(JwsHeader header) {
5257
try {
@@ -160,6 +165,8 @@ public static class Builder {
160165
private Duration requestTimeout = Duration.ofSeconds(10);
161166
private int keyTtl = 60 * 1000;
162167

168+
private Builder() {}
169+
163170
/**
164171
* Setter for JWKS URI. The JWKS URI typically follows a well-known pattern, such as
165172
* https://server_domain/.well-known/jwks.json. This endpoint is a read-only URL that responds

‎vault/src/main/java/io/scalecube/security/vault/VaultServiceRolesInstaller.java‎

Lines changed: 34 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
import java.io.IOException;
1313
import java.io.InputStream;
1414
import java.io.StringReader;
15+
import java.nio.charset.StandardCharsets;
1516
import java.util.Base64;
1617
import java.util.Collections;
1718
import java.util.List;
@@ -49,32 +50,39 @@ public class VaultServiceRolesInstaller {
4950
private final TimeUnit timeUnit;
5051

5152
private VaultServiceRolesInstaller(Builder builder) {
52-
this.vaultAddress = builder.vaultAddress;
53-
this.vaultTokenSupplier = builder.vaultTokenSupplier;
54-
this.keyNameSupplier = builder.keyNameSupplier;
55-
this.roleNameBuilder = builder.roleNameBuilder;
56-
this.serviceRolesSources = builder.serviceRolesSources;
57-
this.keyAlgorithm = builder.keyAlgorithm;
58-
this.keyRotationPeriod = builder.keyRotationPeriod;
59-
this.keyVerificationTtl = builder.keyVerificationTtl;
60-
this.roleTtl = builder.roleTtl;
53+
this.vaultAddress = Objects.requireNonNull(builder.vaultAddress, "vaultAddress");
54+
this.vaultTokenSupplier =
55+
Objects.requireNonNull(builder.vaultTokenSupplier, "vaultTokenSupplier");
56+
this.keyNameSupplier = Objects.requireNonNull(builder.keyNameSupplier, "keyNameSupplier");
57+
this.roleNameBuilder = Objects.requireNonNull(builder.roleNameBuilder, "roleNameBuilder");
58+
this.serviceRolesSources =
59+
Objects.requireNonNull(builder.serviceRolesSources, "serviceRolesSources");
60+
this.keyAlgorithm = Objects.requireNonNull(builder.keyAlgorithm, "keyAlgorithm");
61+
this.keyRotationPeriod = Objects.requireNonNull(builder.keyRotationPeriod, "keyRotationPeriod");
62+
this.keyVerificationTtl =
63+
Objects.requireNonNull(builder.keyVerificationTtl, "keyVerificationTtl");
64+
this.roleTtl = Objects.requireNonNull(builder.roleTtl, "roleTtl");
6165
this.timeout = builder.timeout;
6266
this.timeUnit = builder.timeUnit;
6367
}
6468

69+
public static Builder builder() {
70+
return new Builder();
71+
}
72+
6573
/**
6674
* Builds vault oidc micro-infrastructure (identity roles and keys) to use it for
6775
* machine-to-machine authentication.
6876
*/
6977
public void install() {
7078
if (isNullOrNoneOrEmpty(vaultAddress)) {
71-
LOGGER.debug("Skipping serviceRoles installation, vaultAddress not set");
79+
LOGGER.debug("Skipping service roles installation, vault address not set");
7280
return;
7381
}
7482

7583
final ServiceRoles serviceRoles = loadServiceRoles();
7684
if (serviceRoles == null || serviceRoles.roles.isEmpty()) {
77-
LOGGER.debug("Skipping serviceRoles installation, serviceRoles not set");
85+
LOGGER.debug("Skipping service roles installation, service roles not set");
7886
return;
7987
}
8088

@@ -87,17 +95,19 @@ public void install() {
8795
final var keyName = keyNameSupplier.get();
8896

8997
createVaultIdentityKey(rest.url(vaultIdentityKeyUri(keyName)), keyName);
98+
LOGGER.debug("Vault identity key: {}", keyName);
9099

91100
for (var role : serviceRoles.roles) {
92-
String roleName = roleNameBuilder.apply(role.role);
101+
final var roleName = roleNameBuilder.apply(role.role);
93102
createVaultIdentityRole(
94103
rest.url(vaultIdentityRoleUri(roleName)),
95104
keyName,
96-
roleName,
105+
role.role,
97106
role.permissions);
107+
LOGGER.debug("Vault identity role: {}", roleName);
98108
}
99109

100-
LOGGER.debug("Installed serviceRoles ({})", serviceRoles);
110+
LOGGER.debug("Installed service roles: {}", serviceRoles);
101111
})
102112
.get(timeout, timeUnit);
103113
} catch (Exception e) {
@@ -106,10 +116,6 @@ public void install() {
106116
}
107117

108118
private ServiceRoles loadServiceRoles() {
109-
if (serviceRolesSources == null) {
110-
return null;
111-
}
112-
113119
for (Supplier<ServiceRoles> serviceRolesSource : serviceRolesSources) {
114120
final ServiceRoles serviceRoles = serviceRolesSource.get();
115121
if (serviceRoles != null) {
@@ -134,11 +140,10 @@ private void createVaultIdentityKey(Rest rest, String keyName) {
134140
.add("allowed_client_ids", "*")
135141
.add("algorithm", keyAlgorithm)
136142
.toString()
137-
.getBytes();
143+
.getBytes(StandardCharsets.UTF_8);
138144

139145
try {
140146
awaitSuccess(rest.body(body).post().getStatus());
141-
LOGGER.debug("Created vault identity key: {}", keyName);
142147
} catch (RestException e) {
143148
throw new RuntimeException("Failed to create vault identity key: " + keyName, e);
144149
}
@@ -149,23 +154,26 @@ private void createVaultIdentityRole(
149154
final byte[] body =
150155
Json.object()
151156
.add("key", keyName)
152-
.add("template", createTemplate(permissions))
157+
.add("template", createTemplate(roleName, permissions))
153158
.add("ttl", roleTtl)
154159
.toString()
155-
.getBytes();
160+
.getBytes(StandardCharsets.UTF_8);
156161

157162
try {
158163
awaitSuccess(rest.body(body).post().getStatus());
159-
LOGGER.debug("Created vault identity role: {}", roleName);
160164
} catch (RestException e) {
161165
throw new RuntimeException("Failed to create vault identity role: " + roleName, e);
162166
}
163167
}
164168

165-
private static String createTemplate(List<String> permissions) {
169+
private static String createTemplate(String roleName, List<String> permissions) {
166170
return Base64.getUrlEncoder()
167171
.encodeToString(
168-
Json.object().add("permissions", String.join(",", permissions)).toString().getBytes());
172+
Json.object()
173+
.add("role", roleName)
174+
.add("permissions", String.join(",", permissions))
175+
.toString()
176+
.getBytes(StandardCharsets.UTF_8));
169177
}
170178

171179
private String vaultIdentityKeyUri(String keyName) {
@@ -363,7 +371,7 @@ public static class Builder {
363371
private long timeout = 10;
364372
private TimeUnit timeUnit = TimeUnit.SECONDS;
365373

366-
public Builder() {}
374+
private Builder() {}
367375

368376
public Builder vaultAddress(String vaultAddress) {
369377
this.vaultAddress = vaultAddress;

‎vault/src/main/java/io/scalecube/security/vault/VaultServiceTokenSupplier.java‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,6 +33,10 @@ private VaultServiceTokenSupplier(Builder builder) {
3333
Objects.requireNonNull(builder.serviceTokenNameBuilder, "serviceTokenNameBuilder");
3434
}
3535

36+
public static Builder builder() {
37+
return new Builder();
38+
}
39+
3640
/**
3741
* Obtains vault service token (aka identity token or oidc token).
3842
*
@@ -98,7 +102,7 @@ public static class Builder {
98102
private Supplier<CompletableFuture<String>> vaultTokenSupplier;
99103
private BiFunction<String, Map<String, String>, String> serviceTokenNameBuilder;
100104

101-
public Builder() {}
105+
private Builder() {}
102106

103107
/**
104108
* Setter for {@code vaultAddress}.

0 commit comments

Comments
 (0)