org.springframework.vault.authentication

Class LifecycleAwareSessionManager

java.lang.Object

org.springframework.vault.authentication.LifecycleAwareSessionManager

All Implemented Interfaces:

org.springframework.beans.factory.DisposableBean, SessionManager

public class LifecycleAwareSessionManager
extends Object
implements SessionManager, org.springframework.beans.factory.DisposableBean

Lifecycle-aware Session Manager. This SessionManager obtains tokens from a ClientAuthentication upon request. Tokens are renewed asynchronously if a token has a lease duration. This happens 5 seconds before the token expires, see REFRESH_PERIOD_BEFORE_EXPIRY.

This SessionManager also implements DisposableBean to revoke the LoginToken once it's not required anymore. Token revocation will stop regular token refresh. Tokens are only revoked only if the associated ClientAuthentication returned a LoginToken.

If Token renewal runs into a client-side error, it assumes the token was revoked/expired and discards the token state so the next attempt will lead to another login attempt.

By default, VaultToken are looked up in Vault to determine renewability and the remaining TTL, see setTokenSelfLookupEnabled(boolean).

Author:

Mark Paluch, Steven Swor

See Also:

LoginToken, SessionManager, AsyncTaskExecutor

Nested Class Summary

Nested Classes

Modifier and Type	Class and Description
static class	LifecycleAwareSessionManager.FixedTimeoutRefreshTrigger LifecycleAwareSessionManager.RefreshTrigger implementation using a fixed timeout to schedule renewal before a LoginToken expires.
static interface	LifecycleAwareSessionManager.RefreshTrigger Common interface for trigger objects that determine the next execution time of a refresh task that they get associated with.

Field Summary

Fields

Modifier and Type	Field and Description
static int	REFRESH_PERIOD_BEFORE_EXPIRY Refresh 5 seconds before the token expires.

Constructor Summary

Constructors

Constructor and Description
LifecycleAwareSessionManager(ClientAuthentication clientAuthentication, org.springframework.scheduling.TaskScheduler taskScheduler, org.springframework.web.client.RestOperations restOperations) Create a LifecycleAwareSessionManager given ClientAuthentication, AsyncTaskExecutor and RestOperations.
LifecycleAwareSessionManager(ClientAuthentication clientAuthentication, org.springframework.scheduling.TaskScheduler taskScheduler, org.springframework.web.client.RestOperations restOperations, LifecycleAwareSessionManager.RefreshTrigger refreshTrigger) Create a LifecycleAwareSessionManager given ClientAuthentication, AsyncTaskExecutor and RestOperations.

Method Summary

Modifier and Type	Method and Description
void	destroy()
VaultToken	getSessionToken() Obtain a session token.
protected boolean	isTokenRenewable()
boolean	isTokenSelfLookupEnabled() Returns whether token self-lookup is enabled to augment VaultToken obtained from a ClientAuthentication.
protected VaultToken	login()
protected boolean	renewToken() Performs a token refresh.
protected void	revoke(VaultToken token) Revoke a VaultToken.
void	setTokenSelfLookupEnabled(boolean tokenSelfLookupEnabled) Enables/disables token self-lookup.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

REFRESH_PERIOD_BEFORE_EXPIRY

public static final int REFRESH_PERIOD_BEFORE_EXPIRY

Refresh 5 seconds before the token expires.

See Also:

Constant Field Values

Constructor Detail

LifecycleAwareSessionManager

public LifecycleAwareSessionManager(ClientAuthentication clientAuthentication,
                                    org.springframework.scheduling.TaskScheduler taskScheduler,
                                    org.springframework.web.client.RestOperations restOperations)

Create a LifecycleAwareSessionManager given ClientAuthentication, AsyncTaskExecutor and RestOperations.

Parameters:

clientAuthentication - must not be null.

taskScheduler - must not be null.

restOperations - must not be null.

LifecycleAwareSessionManager

public LifecycleAwareSessionManager(ClientAuthentication clientAuthentication,
                                    org.springframework.scheduling.TaskScheduler taskScheduler,
                                    org.springframework.web.client.RestOperations restOperations,
                                    LifecycleAwareSessionManager.RefreshTrigger refreshTrigger)

Create a LifecycleAwareSessionManager given ClientAuthentication, AsyncTaskExecutor and RestOperations.

Parameters:

clientAuthentication - must not be null.

taskScheduler - must not be null.

restOperations - must not be null.

refreshTrigger - must not be null.

Since:

1.0.1

Method Detail

isTokenSelfLookupEnabled

public boolean isTokenSelfLookupEnabled()

Returns whether token self-lookup is enabled to augment VaultToken obtained from a ClientAuthentication. Self-lookup determines whether a token is renewable and its TTL. Self lookup is skipped for LoginToken. Self-lookup requests decrement token usage count by one. Skipped for LoginToken.

Self-lookup for tokens without a permission to access auth/token/lookup-self will fail gracefully and continue without token renewal.

Returns:

true to enable self-lookup, false to disable self-lookup. Enabled by default.

Since:

2.0

setTokenSelfLookupEnabled

public void setTokenSelfLookupEnabled(boolean tokenSelfLookupEnabled)

Enables/disables token self-lookup. Self-lookup augments VaultToken obtained from a ClientAuthentication. Self-lookup determines whether a token is renewable and its TTL.

Parameters:

tokenSelfLookupEnabled - true to enable self-lookup, false to disable self-lookup. Enabled by default.

Since:

2.0

destroy

public void destroy()

Specified by:

destroy in interface org.springframework.beans.factory.DisposableBean

revoke

protected void revoke(VaultToken token)

Revoke a VaultToken.

Parameters:

token - the token to revoke, must not be null.

renewToken

protected boolean renewToken()

Performs a token refresh. Create a new token if no token was obtained before. If a token was obtained before, it uses self-renewal to renew the current token. Client-side errors (like permission denied) indicate the token cannot be renewed because it's expired or simply not found.

Returns:

true if the refresh was successful. false if a new token was obtained or refresh failed.

getSessionToken

public VaultToken getSessionToken()

Description copied from interface: SessionManager

Obtain a session token.

Specified by:

getSessionToken in interface SessionManager

Returns:

a session token.

login

protected VaultToken login()

isTokenRenewable

protected boolean isTokenRenewable()