Skip to content

Commit 671d5c8

Browse files
schulzhschulzh
committed
refactor token creation methods and add creation against roles
1 parent 35edfa2 commit 671d5c8

File tree

1 file changed

+233
-13
lines changed
  • src/main/java/com/bettercloud/vault/api

1 file changed

+233
-13
lines changed

‎src/main/java/com/bettercloud/vault/api/Auth.java‎

Lines changed: 233 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,194 @@
2424
*/
2525
public class Auth {
2626

27+
/**
28+
* Builder-style class for use with {@link #createToken(TokenRequest)}
29+
*
30+
* <p>All properties are optional and can be <code>null</code>.</p>
31+
*/
32+
public static class TokenRequest {
33+
/**
34+
* (optional) The ID of the client token. Can only be specified by a root token. Otherwise, the token ID is a randomly generated UUID.
35+
*/
36+
UUID id;
37+
38+
/**
39+
* (optional) A list of policies for the token. This must be a subset of the policies belonging to the token making the request, unless root. If not specified, defaults to all the policies of the calling token.
40+
*/
41+
List<String> polices;
42+
43+
/**
44+
* (optional) A map of string to string valued metadata. This is passed through to the audit backends.
45+
*/
46+
Map<String, String> meta;
47+
48+
/**
49+
* (optional) If true and set by a root caller, the token will not have the parent token of the caller. This creates a token with no parent.
50+
*/
51+
Boolean noParent;
52+
53+
/**
54+
* (optional) If <code>true</code> the default policy will not be a part of this token's policy set.
55+
*/
56+
Boolean noDefaultPolicy;
57+
58+
/**
59+
* (optional) The TTL period of the token, provided as "1h", where hour is the largest suffix. If not provided, the token is valid for the default lease TTL, or indefinitely if the root policy is used.
60+
*/
61+
String ttl;
62+
63+
/**
64+
* (optional) The display name of the token. Defaults to "token".
65+
*/
66+
String displayName;
67+
68+
/**
69+
* (optional) The maximum uses for the given token. This can be used to create a one-time-token or limited use token. Defaults to 0, which has no limit to the number of uses.
70+
*/
71+
Long numUses;
72+
73+
/**
74+
* (optional) The role the token will be created with. Default is no role.
75+
*/
76+
String role;
77+
78+
/**
79+
* {@link #id}
80+
*/
81+
public TokenRequest withId(UUID id) {
82+
this.id = id;
83+
return this;
84+
}
85+
86+
/**
87+
* {@link #polices}
88+
*/
89+
public TokenRequest withPolices(List<String> polices) {
90+
this.polices = polices;
91+
return this;
92+
}
93+
94+
/**
95+
* {@link #meta}
96+
*/
97+
public TokenRequest withMeta(Map<String, String> meta) {
98+
this.meta = meta;
99+
return this;
100+
}
101+
102+
/**
103+
* {@link #noParent}
104+
*/
105+
public TokenRequest withNoParent(Boolean noParent) {
106+
this.noParent = noParent;
107+
return this;
108+
}
109+
110+
/**
111+
* {@link #noDefaultPolicy}
112+
*/
113+
public TokenRequest withNoDefaultPolicy(Boolean noDefaultPolicy) {
114+
this.noDefaultPolicy = noDefaultPolicy;
115+
return this;
116+
}
117+
118+
/**
119+
* {@link #ttl}
120+
*/
121+
public TokenRequest withTtl(String ttl) {
122+
this.ttl = ttl;
123+
return this;
124+
}
125+
126+
/**
127+
* {@link #displayName}
128+
*/
129+
public TokenRequest withDisplayName(String displayName) {
130+
this.displayName = displayName;
131+
return this;
132+
}
133+
134+
/**
135+
* {@link #numUses}
136+
*/
137+
public TokenRequest withNumUses(Long numUses) {
138+
this.numUses = numUses;
139+
return this;
140+
}
141+
142+
/**
143+
* {@link #role}
144+
*/
145+
public TokenRequest withRole(String role) {
146+
this.role = role;
147+
return this;
148+
}
149+
150+
151+
/**
152+
* {@link #id}
153+
*/
154+
public UUID getId() {
155+
return id;
156+
}
157+
158+
/**
159+
* {@link #polices}
160+
*/
161+
public List<String> getPolices() {
162+
return polices;
163+
}
164+
165+
/**
166+
* {@link #meta}
167+
*/
168+
public Map<String, String> getMeta() {
169+
return meta;
170+
}
171+
172+
/**
173+
* {@link #noParent}
174+
*/
175+
public Boolean getNoParent() {
176+
return noParent;
177+
}
178+
179+
/**
180+
* {@link #noDefaultPolicy}
181+
*/
182+
public Boolean getNoDefaultPolicy() {
183+
return noDefaultPolicy;
184+
}
185+
186+
/**
187+
* {@link #ttl}
188+
*/
189+
public String getTtl() {
190+
return ttl;
191+
}
192+
193+
/**
194+
* {@link #displayName}
195+
*/
196+
public String getDisplayName() {
197+
return displayName;
198+
}
199+
200+
/**
201+
* {@link #numUses}
202+
*/
203+
public Long getNumUses() {
204+
return numUses;
205+
}
206+
207+
/**
208+
* {@link #role}
209+
*/
210+
public String getRole() {
211+
return role;
212+
}
213+
}
214+
27215
private final VaultConfig config;
28216

29217
public Auth(final VaultConfig config) {
@@ -56,7 +244,9 @@ public Auth(final VaultConfig config) {
56244
* @param numUses (optional) The maximum uses for the given token. This can be used to create a one-time-token or limited use token. Defaults to 0, which has no limit to the number of uses.
57245
* @return The auth token
58246
* @throws VaultException If any error occurs, or unexpected response received from Vault
247+
* @deprecated Use {@link #createToken(TokenRequest)}
59248
*/
249+
@Deprecated
60250
public AuthResponse createToken(
61251
final UUID id,
62252
final List<String> polices,
@@ -67,39 +257,69 @@ public AuthResponse createToken(
67257
final String displayName,
68258
final Long numUses
69259
) throws VaultException {
260+
return createToken(
261+
new TokenRequest()
262+
.withId(id)
263+
.withPolices(polices)
264+
.withMeta(meta)
265+
.withNoParent(noParent)
266+
.withNoDefaultPolicy(noDefaultPolicy)
267+
.withTtl(ttl)
268+
.withDisplayName(displayName)
269+
.withNumUses(numUses));
270+
}
271+
272+
273+
/**
274+
* <p>Operation to create an authentication token. Relies on another token already being present in
275+
* the <code>VaultConfig</code> instance. Example usage:</p>
276+
*
277+
* <blockquote>
278+
* <pre>{@code
279+
* final VaultConfig config = new VaultConfig(address, rootToken);
280+
* final Vault vault = new Vault(config);
281+
* final AuthResponse response = vault.auth().createToken(new TokenRequest().withTtl("1h"));
282+
*
283+
* final String token = response.getAuthClientToken();
284+
* }</pre>
285+
* </blockquote> */
286+
public AuthResponse createToken(TokenRequest tokenRequest) throws VaultException {
70287
int retryCount = 0;
71288
while (true) {
72289
try {
73290
// Parse parameters to JSON
74291
final JsonObject jsonObject = Json.object();
75-
if (id != null) jsonObject.add("id", id.toString());
76-
if (polices != null && !polices.isEmpty()) {
292+
if (tokenRequest.id != null) jsonObject.add("id", tokenRequest.id.toString());
293+
if (tokenRequest.polices != null && !tokenRequest.polices.isEmpty()) {
77294
final StringBuilder policiesCsv = new StringBuilder();//NOPMD
78-
for (int index = 0; index < polices.size(); index++) {
79-
policiesCsv.append(polices.get(index));
80-
if (index + 1 < polices.size()) {
295+
for (int index = 0; index < tokenRequest.polices.size(); index++) {
296+
policiesCsv.append(tokenRequest.polices.get(index));
297+
if (index + 1 < tokenRequest.polices.size()) {
81298
policiesCsv.append(',');
82299
}
83300
}
84301
jsonObject.add("polices", policiesCsv.toString());
85302
}
86-
if (meta != null && !meta.isEmpty()) {
303+
if (tokenRequest.meta != null && !tokenRequest.meta.isEmpty()) {
87304
final JsonObject metaMap = Json.object();
88-
for (final Map.Entry<String, String> entry : meta.entrySet()) {
305+
for (final Map.Entry<String, String> entry : tokenRequest.meta.entrySet()) {
89306
metaMap.add(entry.getKey(), entry.getValue());
90307
}
91308
jsonObject.add("meta", metaMap);
92309
}
93-
if (noParent != null) jsonObject.add("no_parent", noParent);
94-
if (noDefaultPolicy != null) jsonObject.add("no_default_policy", noDefaultPolicy);
95-
if (ttl != null) jsonObject.add("ttl", ttl);
96-
if (displayName != null) jsonObject.add("display_name", displayName);
97-
if (numUses != null) jsonObject.add("num_uses", numUses);
310+
if (tokenRequest.noParent != null) jsonObject.add("no_parent", tokenRequest.noParent);
311+
if (tokenRequest.noDefaultPolicy != null) jsonObject.add("no_default_policy", tokenRequest.noDefaultPolicy);
312+
if (tokenRequest.ttl != null) jsonObject.add("ttl", tokenRequest.ttl);
313+
if (tokenRequest.displayName != null) jsonObject.add("display_name", tokenRequest.displayName);
314+
if (tokenRequest.numUses != null) jsonObject.add("num_uses", tokenRequest.numUses);
98315
final String requestJson = jsonObject.toString();
99316

317+
String url = config.getAddress() + "/v1/auth/token/create";
318+
if (tokenRequest.role != null) url += "/" + tokenRequest.role;
319+
100320
// HTTP request to Vault
101321
final RestResponse restResponse = new Rest()//NOPMD
102-
.url(config.getAddress() + "/v1/auth/token/create")
322+
.url(url)
103323
.header("X-Vault-Token", config.getToken())
104324
.body(requestJson.getBytes("UTF-8"))
105325
.connectTimeoutSeconds(config.getOpenTimeout())

0 commit comments

Comments
 (0)